Update build workflow.

.webhook_bridge/pipeline-build-hash.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:

.webhook_bridge/pipeline-foreign-document-test.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: foreign-document-test
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:

.webhook_bridge/pipeline-format.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-format
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:

.webhook_bridge/pipeline-rust-clippy.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-clippy
+  labels:
+    pdb: protect
 spec:
   taskRunTemplate:
     serviceAccountName: build-bot
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:

.webhook_bridge/pipeline-rust-test.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-test
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -62,7 +64,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +103,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:

flake.nix

@@ -35,9 +35,9 @@
           pkgs = import nixpkgs {
             inherit system overlays;
           };
-          rustToolchain =
+          rustToolchain = (pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml).override {
-            (pkgs.pkgsBuildHost.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml).override
+            targets = [ "wasm32-unknown-unknown" ];
-              { targets = [ "wasm32-unknown-unknown" ]; };
+          };
         in
         {
           default = pkgs.mkShell {
@@ -96,6 +96,7 @@
                 bindgenTarget ? null,
               }:
               (organicScope.callPackage ./nix/package.nix {
+                inherit rust-overlay;
                 targetBins = [
                   "wasm"
                 ];
@@ -128,18 +129,24 @@
                 );
           in
           {
-            library = (organicScope.callPackage ./nix/package.nix { buildLib = true; }).overrideAttrs (
+            library =
-              old:
+              (organicScope.callPackage ./nix/package.nix {
-              let
+                inherit rust-overlay;
-              in
+                buildLib = true;
-              {
+              }).overrideAttrs
-                installPhase = ''
+                (
-                  mkdir -p $out/lib
+                  old:
-                  cp target/*/release/liborganic.rlib $out/lib/
+                  let
-                '';
+                  in
-              }
+                  {
-            );
+                    installPhase = ''
+                      mkdir -p $out/lib
+                      cp target/*/release/liborganic.rlib $out/lib/
+                    '';
+                  }
+                );
             devTools = organicScope.callPackage ./nix/package.nix {
+              inherit rust-overlay;
               targetBins = [
                 "parse"
                 "compare"

nix/package.nix

@@ -1,8 +1,8 @@
 {
   hello,
   lib,
-  makeRustPlatform,
+  pkgs,
-  pkgsBuildHost,
+  rust-overlay,
 
   targetBins ? [ ],
   features ? [ ],
@@ -12,34 +12,41 @@
 }:
 let
   cargoToml = (lib.importTOML ../Cargo.toml);
-  rustToolchain = (pkgsBuildHost.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml).override (
+  rustPlatformFor =
-    if cargoBuildTarget != null then
+    pkgs:
-      {
+    let
-        targets = [ cargoBuildTarget ];
+      rust-bin = rust-overlay.lib.mkRustBin { } pkgs;
-      }
+      rustToolchain = (rust-bin.fromRustupToolchainFile ../rust-toolchain.toml).override (
-    else
+        if cargoBuildTarget != null then
-      { }
+          {
-  );
+            targets = [ cargoBuildTarget ];
-  baseRustPlatform = (
+          }
-    makeRustPlatform {
+        else
-      cargo = rustToolchain;
+          { }
-      rustc = rustToolchain;
+      );
-    }
+      baseRustPlatform = (
-  );
+        pkgs.makeRustPlatform {
-  rustPlatform =
+          cargo = rustToolchain;
-    if cargoBuildTarget != null then
+          rustc = rustToolchain;
-      baseRustPlatform.overrideScope (
-        final: prev: {
-          cargoBuildHook = prev.cargoBuildHook.overrideDerivation (_: {
-            rustcTargetSpec = cargoBuildTarget;
-          });
-          cargoInstallHook = hello;
         }
-      )
+      );
-    else
+      rustPlatform =
-      baseRustPlatform;
+        if cargoBuildTarget != null then
+          baseRustPlatform.overrideScope (
+            final: prev: {
+              cargoBuildHook = prev.cargoBuildHook.overrideDerivation (_: {
+                rustcTargetSpec = cargoBuildTarget;
+              });
+              cargoInstallHook = hello;
+            }
+          )
+        else
+          baseRustPlatform;
+    in
+    rustPlatform;
 in
-rustPlatform.buildRustPackage (
+(rustPlatformFor pkgs).buildRustPackage (
+  # rustPlatform.buildRustPackage (
   {
     pname = "organic";
     version = cargoToml.package.version;

rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "nightly"
+channel = "nightly-2026-05-23"
 profile = "default"
 components = ["clippy", "rustfmt"]