TEMP test

Using ADD to clone git repos breaks caching.

.dockerignore

@@ -3,3 +3,4 @@ target
 Cargo.lock
 notes/
 .lighthouse/
+/.webhook_bridge/

.gitignore

@@ -1,3 +1,3 @@
 /target
-Cargo.lock
 TODO.org
+/result

.webhook_bridge/pipeline-build-hash.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: build
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,42 +59,86 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
+      - name: get-git-commit-time
+        taskSpec:
+          metadata: {}
+          stepTemplate:
+            image: alpine:3.20
+            computeResources:
+              requests:
+                cpu: 10m
+                memory: 600Mi
+            workingDir: "$(workspaces.repo.path)"
+          results:
+            - name: unix-time
+              description: The time of the git commit in unix timestamp format.
+          steps:
+            - image: alpine/git:v2.34.2
+              name: detect-tag-step
+              script: |
+                #!/usr/bin/env sh
+                set -euo pipefail
+                echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path)
+        workspaces:
+          - name: repo
+            workspace: git-source
+        runAfter:
+          - fetch-repository
       - name: build-image
         taskRef:
           resolver: git
           params:
             - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
-              value: task/kaniko/0.6/kaniko.yaml
+              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
-          - name: IMAGE
+          - name: OUTPUT
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: >-
+              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
           - name: CONTEXT
             value: $(params.path-to-image-context)
           - name: DOCKERFILE
             value: $(params.path-to-dockerfile)
-          - name: BUILDER_IMAGE
-            value: "gcr.io/kaniko-project/executor:v1.12.1"
           - name: EXTRA_ARGS
             value:
-              - "--destination=$(params.image-name)" # Also write the :latest image
+              - "--opt"
-              - "--target=$(params.target-name)"
+              - "target=$(params.target-name)"
-              - --cache=true
+              - --import-cache
-              - --cache-copy-layers
+              - "type=registry,ref=$(params.image-name):buildcache"
-              - --cache-repo=harbor.fizz.buzz/kanikocache/cache
+              - --export-cache
-              - --use-new-run # Should result in a speed-up
+              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --reproducible # To remove timestamps so layer caching works.
+              - --opt
-              - --snapshot-mode=redo
+              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --skip-unused-stages=true
+          - name: BUILDKITD_TOML
-              - --registry-mirror=dockerhub.dockerhub.svc.cluster.local
+            value: |
+              debug = true
+              [registry."docker.io"]
+                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
+              [registry."dockerhub.dockerhub.svc.cluster.local"]
+                http = true
+                insecure = true
         workspaces:
           - name: source
             workspace: git-source
           - name: dockerconfig
             workspace: docker-credentials
+        runAfter:
+          - fetch-repository
       #############
       - name: run-image-none
         taskSpec:
@@ -113,11 +147,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -137,6 +170,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -147,7 +182,7 @@ spec:
           - build-image
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
       - name: run-image-tracing
         taskSpec:
@@ -156,11 +191,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -180,6 +214,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -190,7 +226,7 @@ spec:
           - run-image-none
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
       - name: run-image-compare
         taskSpec:
@@ -199,11 +235,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -223,6 +258,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -233,7 +270,7 @@ spec:
           - run-image-tracing
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
       - name: run-image-default
         taskSpec:
@@ -242,11 +279,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -266,6 +302,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -276,7 +314,7 @@ spec:
           - run-image-compare
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
       - name: run-image-tracing-compare
         taskSpec:
@@ -285,11 +323,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -309,6 +346,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -319,7 +358,7 @@ spec:
           - run-image-default
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
       - name: run-image-compare-foreign
         taskSpec:
@@ -328,11 +367,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -357,6 +395,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -367,7 +407,7 @@ spec:
           - run-image-tracing-compare
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
       - name: run-image-all
         taskSpec:
@@ -376,11 +416,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -405,6 +444,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -415,7 +456,7 @@ spec:
           - run-image-compare-foreign
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
       - name: run-image-wasm
         taskSpec:
@@ -424,11 +465,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -459,6 +499,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -469,7 +511,7 @@ spec:
           - run-image-all
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
       - name: run-image-wasm-test
         taskSpec:
@@ -478,11 +520,10 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
           stepTemplate:
-            image: alpine:3.18
+            image: alpine:3.20
-            name: ""
+            computeResources:
-            resources:
               requests:
                 cpu: 10m
                 memory: 60Mi
@@ -509,6 +550,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -519,7 +562,7 @@ spec:
           - run-image-wasm
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       #############
     finally:
       - name: report-success
@@ -587,17 +630,13 @@ spec:
             - name: docker-image
               type: string
               description: Docker image to run.
-              default: alpine:3.18
+              default: alpine:3.20
-            - name: cache-subdir
+          stepTemplate:
-              type: string
+            image: alpine:3.20
-              description: subPath used in the persistent volume for the cargo cache.
+            computeResources:
-          steptemplate:
-            image: alpine:3.18
-            name: ""
-            resources:
               requests:
                 cpu: 10m
-                memory: 60Mi
+                memory: 600Mi
             workingDir: /workspace/source
           workspaces:
             - name: source
@@ -609,21 +648,19 @@ spec:
             - name: run
               image: $(params.docker-image)
               workingDir: "$(workspaces.source.path)"
-              command: ["ls", "$(workspaces.cargo-cache.path)"]
+              command: [cargo, cache, --autoclean]
-              # command: [echo, $(params.cache-subdir)]
-              # command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
           - name: cargo-cache
             workspace: cargo-cache
-            subPath: $(params.cache-subdir)
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
-          - name: cache-subdir
-            value: none
         # matrix:
         #   params:
         #     - name: cache-subdir
@@ -645,7 +682,7 @@ spec:
     - name: git-source
       volumeClaimTemplate:
         spec:
-          storageClassName: "nfs-client"
+          storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
           resources:
@@ -666,4 +703,4 @@ spec:
     - name: path-to-image-context
       value: .
     - name: path-to-dockerfile
-      value: docker/organic_development/Dockerfile
+      value: docker/organic_development/

.webhook_bridge/pipeline-foreign-document-test.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: foreign-document-test
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,41 +59,86 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
+      - name: get-git-commit-time
+        taskSpec:
+          metadata: {}
+          stepTemplate:
+            image: alpine:3.20
+            computeResources:
+              requests:
+                cpu: 10m
+                memory: 600Mi
+            workingDir: "$(workspaces.repo.path)"
+          results:
+            - name: unix-time
+              description: The time of the git commit in unix timestamp format.
+          steps:
+            - image: alpine/git:v2.34.2
+              name: detect-tag-step
+              script: |
+                #!/usr/bin/env sh
+                set -euo pipefail
+                echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path)
+        workspaces:
+          - name: repo
+            workspace: git-source
+        runAfter:
+          - fetch-repository
       - name: build-image
         taskRef:
           resolver: git
           params:
             - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
-              value: task/kaniko/0.6/kaniko.yaml
+              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
-          - name: IMAGE
+          - name: OUTPUT
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: >-
+              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
           - name: CONTEXT
             value: $(params.path-to-image-context)
           - name: DOCKERFILE
             value: $(params.path-to-dockerfile)
-          - name: BUILDER_IMAGE
-            value: "gcr.io/kaniko-project/executor:v1.12.1"
           - name: EXTRA_ARGS
             value:
-              - "--target=$(params.target-name)"
+              - "--opt"
-              - --cache=true
+              - "target=$(params.target-name)"
-              - --cache-copy-layers
+              - --import-cache
-              - --cache-repo=harbor.fizz.buzz/kanikocache/cache
+              - "type=registry,ref=$(params.image-name):buildcache"
-              - --use-new-run # Should result in a speed-up
+              - --export-cache
-              - --reproducible # To remove timestamps so layer caching works.
+              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --snapshot-mode=redo
+              - --opt
-              - --skip-unused-stages=true
+              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --registry-mirror=dockerhub.dockerhub.svc.cluster.local
+          - name: BUILDKITD_TOML
+            value: |
+              debug = true
+              [registry."docker.io"]
+                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
+              [registry."dockerhub.dockerhub.svc.cluster.local"]
+                http = true
+                insecure = true
         workspaces:
           - name: source
             workspace: git-source
           - name: dockerconfig
             workspace: docker-credentials
+        runAfter:
+          - fetch-repository
       - name: run-test
         taskSpec:
           metadata: {}
@@ -132,6 +167,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -141,7 +178,7 @@ spec:
           - build-image
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
     finally:
       - name: report-success
         when:
@@ -228,6 +265,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -235,7 +275,7 @@ spec:
             workspace: cargo-cache
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
     workspaces:
       - name: git-source
       - name: docker-credentials
@@ -244,7 +284,7 @@ spec:
     - name: git-source
       volumeClaimTemplate:
         spec:
-          storageClassName: "nfs-client"
+          storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
           resources:
@@ -265,4 +305,4 @@ spec:
     - name: path-to-image-context
       value: docker/organic_test/
     - name: path-to-dockerfile
-      value: docker/organic_test/Dockerfile
+      value: docker/organic_test/

.webhook_bridge/pipeline-format.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-format
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,41 +59,86 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
+      - name: get-git-commit-time
+        taskSpec:
+          metadata: {}
+          stepTemplate:
+            image: alpine:3.20
+            computeResources:
+              requests:
+                cpu: 10m
+                memory: 600Mi
+            workingDir: "$(workspaces.repo.path)"
+          results:
+            - name: unix-time
+              description: The time of the git commit in unix timestamp format.
+          steps:
+            - image: alpine/git:v2.34.2
+              name: detect-tag-step
+              script: |
+                #!/usr/bin/env sh
+                set -euo pipefail
+                echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path)
+        workspaces:
+          - name: repo
+            workspace: git-source
+        runAfter:
+          - fetch-repository
       - name: build-image
         taskRef:
           resolver: git
           params:
             - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
-              value: task/kaniko/0.6/kaniko.yaml
+              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
-          - name: IMAGE
+          - name: OUTPUT
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: >-
+              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
           - name: CONTEXT
             value: $(params.path-to-image-context)
           - name: DOCKERFILE
             value: $(params.path-to-dockerfile)
-          - name: BUILDER_IMAGE
-            value: "gcr.io/kaniko-project/executor:v1.12.1"
           - name: EXTRA_ARGS
             value:
-              - "--target=$(params.target-name)"
+              - "--opt"
-              - --cache=true
+              - "target=$(params.target-name)"
-              - --cache-copy-layers
+              - --import-cache
-              - --cache-repo=harbor.fizz.buzz/kanikocache/cache
+              - "type=registry,ref=$(params.image-name):buildcache"
-              - --use-new-run # Should result in a speed-up
+              - --export-cache
-              - --reproducible # To remove timestamps so layer caching works.
+              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --snapshot-mode=redo
+              - --opt
-              - --skip-unused-stages=true
+              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --registry-mirror=dockerhub.dockerhub.svc.cluster.local
+          - name: BUILDKITD_TOML
+            value: |
+              debug = true
+              [registry."docker.io"]
+                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
+              [registry."dockerhub.dockerhub.svc.cluster.local"]
+                http = true
+                insecure = true
         workspaces:
           - name: source
             workspace: git-source
           - name: dockerconfig
             workspace: docker-credentials
+        runAfter:
+          - fetch-repository
       - name: run-cargo-fmt
         taskSpec:
           metadata: {}
@@ -134,6 +169,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -143,7 +180,7 @@ spec:
           - build-image
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
       - name: commit-changes
         taskRef:
           resolver: git
@@ -261,6 +298,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -268,7 +308,7 @@ spec:
             workspace: cargo-cache
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
     workspaces:
       - name: git-source
       - name: docker-credentials
@@ -277,7 +317,7 @@ spec:
     - name: git-source
       volumeClaimTemplate:
         spec:
-          storageClassName: "nfs-client"
+          storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
           resources:
@@ -298,4 +338,4 @@ spec:
     - name: path-to-image-context
       value: docker/organic_development/
     - name: path-to-dockerfile
-      value: docker/organic_development/Dockerfile
+      value: docker/organic_development/

.webhook_bridge/pipeline-rust-clippy.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-clippy
+  labels:
+    pdb: protect
 spec:
   taskRunTemplate:
     serviceAccountName: build-bot
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,41 +59,86 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
+      - name: get-git-commit-time
+        taskSpec:
+          metadata: {}
+          stepTemplate:
+            image: alpine:3.20
+            computeResources:
+              requests:
+                cpu: 10m
+                memory: 600Mi
+            workingDir: "$(workspaces.repo.path)"
+          results:
+            - name: unix-time
+              description: The time of the git commit in unix timestamp format.
+          steps:
+            - image: alpine/git:v2.34.2
+              name: detect-tag-step
+              script: |
+                #!/usr/bin/env sh
+                set -euo pipefail
+                echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path)
+        workspaces:
+          - name: repo
+            workspace: git-source
+        runAfter:
+          - fetch-repository
       - name: build-image
         taskRef:
           resolver: git
           params:
             - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
-              value: task/kaniko/0.6/kaniko.yaml
+              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
-          - name: IMAGE
+          - name: OUTPUT
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: >-
+              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
           - name: CONTEXT
             value: $(params.path-to-image-context)
           - name: DOCKERFILE
             value: $(params.path-to-dockerfile)
-          - name: BUILDER_IMAGE
-            value: "gcr.io/kaniko-project/executor:v1.12.1"
           - name: EXTRA_ARGS
             value:
-              - "--target=$(params.target-name)"
+              - "--opt"
-              - --cache=true
+              - "target=$(params.target-name)"
-              - --cache-copy-layers
+              - --import-cache
-              - --cache-repo=harbor.fizz.buzz/kanikocache/cache
+              - "type=registry,ref=$(params.image-name):buildcache"
-              - --use-new-run # Should result in a speed-up
+              - --export-cache
-              - --reproducible # To remove timestamps so layer caching works.
+              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --snapshot-mode=redo
+              - --opt
-              - --skip-unused-stages=true
+              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --registry-mirror=dockerhub.dockerhub.svc.cluster.local
+          - name: BUILDKITD_TOML
+            value: |
+              debug = true
+              [registry."docker.io"]
+                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
+              [registry."dockerhub.dockerhub.svc.cluster.local"]
+                http = true
+                insecure = true
         workspaces:
           - name: source
             workspace: git-source
           - name: dockerconfig
             workspace: docker-credentials
+        runAfter:
+          - fetch-repository
       - name: run-cargo-clippy
         taskSpec:
           metadata: {}
@@ -144,6 +179,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -153,7 +190,7 @@ spec:
           - build-image
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
     finally:
       - name: report-success
         when:
@@ -240,6 +277,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -247,7 +287,7 @@ spec:
             workspace: cargo-cache
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
     workspaces:
       - name: git-source
       - name: docker-credentials
@@ -256,7 +296,7 @@ spec:
     - name: git-source
       volumeClaimTemplate:
         spec:
-          storageClassName: "nfs-client"
+          storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
           resources:
@@ -277,4 +317,4 @@ spec:
     - name: path-to-image-context
       value: docker/organic_development/
     - name: path-to-dockerfile
-      value: docker/organic_development/Dockerfile
+      value: docker/organic_development/

.webhook_bridge/pipeline-rust-test.yaml

@@ -2,6 +2,8 @@ apiVersion: tekton.dev/v1
 kind: PipelineRun
 metadata:
   name: rust-test
+  labels:
+    pdb: protect
 spec:
   timeouts:
     pipeline: "2h0m0s"
@@ -50,18 +52,6 @@ spec:
           - name: TARGET_URL
             value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)"
       - name: fetch-repository
-        taskRef:
-          resolver: git
-          params:
-            - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
-            - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
-            - name: pathInRepo
-              value: task/git-clone/0.9/git-clone.yaml
-        workspaces:
-          - name: output
-            workspace: git-source
         params:
           - name: url
             value: $(params.REPO_URL)
@@ -69,41 +59,86 @@ spec:
             value: $(params.PULL_BASE_SHA)
           - name: deleteExisting
             value: "true"
+        taskRef:
+          params:
+            - name: url
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
+            - name: revision
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
+            - name: pathInRepo
+              value: task/git-clone/0.1/git-clone.yaml
+          resolver: git
+        workspaces:
+          - name: output
+            workspace: git-source
+      - name: get-git-commit-time
+        taskSpec:
+          metadata: {}
+          stepTemplate:
+            image: alpine:3.20
+            computeResources:
+              requests:
+                cpu: 10m
+                memory: 600Mi
+            workingDir: "$(workspaces.repo.path)"
+          results:
+            - name: unix-time
+              description: The time of the git commit in unix timestamp format.
+          steps:
+            - image: alpine/git:v2.34.2
+              name: detect-tag-step
+              script: |
+                #!/usr/bin/env sh
+                set -euo pipefail
+                echo -n "$(git log -1 --pretty=%ct)" | tee $(results.unix-time.path)
+        workspaces:
+          - name: repo
+            workspace: git-source
+        runAfter:
+          - fetch-repository
       - name: build-image
         taskRef:
           resolver: git
           params:
             - name: url
-              value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git
+              value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: df36b3853a5657fd883015cdbf07ad6466918acf
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
-              value: task/kaniko/0.6/kaniko.yaml
+              value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
-          - name: IMAGE
+          - name: OUTPUT
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: >-
+              type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true
           - name: CONTEXT
             value: $(params.path-to-image-context)
           - name: DOCKERFILE
             value: $(params.path-to-dockerfile)
-          - name: BUILDER_IMAGE
-            value: "gcr.io/kaniko-project/executor:v1.12.1"
           - name: EXTRA_ARGS
             value:
-              - "--target=$(params.target-name)"
+              - "--opt"
-              - --cache=true
+              - "target=$(params.target-name)"
-              - --cache-copy-layers
+              - --import-cache
-              - --cache-repo=harbor.fizz.buzz/kanikocache/cache
+              - "type=registry,ref=$(params.image-name):buildcache"
-              - --use-new-run # Should result in a speed-up
+              - --export-cache
-              - --reproducible # To remove timestamps so layer caching works.
+              - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
-              - --snapshot-mode=redo
+              - --opt
-              - --skip-unused-stages=true
+              - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
-              - --registry-mirror=dockerhub.dockerhub.svc.cluster.local
+          - name: BUILDKITD_TOML
+            value: |
+              debug = true
+              [registry."docker.io"]
+                mirrors = ["dockerhub.dockerhub.svc.cluster.local"]
+              [registry."dockerhub.dockerhub.svc.cluster.local"]
+                http = true
+                insecure = true
         workspaces:
           - name: source
             workspace: git-source
           - name: dockerconfig
             workspace: docker-credentials
+        runAfter:
+          - fetch-repository
       - name: run-cargo-test
         taskSpec:
           metadata: {}
@@ -143,6 +178,8 @@ spec:
               env:
                 - name: CARGO_TARGET_DIR
                   value: /target
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -152,7 +189,7 @@ spec:
           - build-image
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
     finally:
       - name: report-success
         when:
@@ -239,6 +276,9 @@ spec:
               workingDir: "$(workspaces.source.path)"
               command: [cargo, cache, --autoclean]
               args: []
+              env:
+                - name: RUSTUP_PERMIT_COPY_RENAME
+                  value: "true"
         workspaces:
           - name: source
             workspace: git-source
@@ -246,7 +286,7 @@ spec:
             workspace: cargo-cache
         params:
           - name: docker-image
-            value: "$(params.image-name):$(tasks.fetch-repository.results.commit)"
+            value: "$(tasks.build-image.results.IMAGE_URL[1])"
     workspaces:
       - name: git-source
       - name: docker-credentials
@@ -255,7 +295,7 @@ spec:
     - name: git-source
       volumeClaimTemplate:
         spec:
-          storageClassName: "nfs-client"
+          storageClassName: "local-path"
           accessModes:
             - ReadWriteOnce
           resources:
@@ -276,4 +316,4 @@ spec:
     - name: path-to-image-context
       value: docker/organic_test/
     - name: path-to-dockerfile
-      value: docker/organic_test/Dockerfile
+      value: docker/organic_test/

.webhook_bridge/webhook_bridge.toml

@@ -1,31 +1,31 @@
 version = "0.0.1"
 
-[[push]]
+# [[push]]
-  name = "rust-test"
+#   name = "rust-test"
-  source = "pipeline-rust-test.yaml"
+#   source = "pipeline-rust-test.yaml"
-  clone_uri = "git@code.fizz.buzz:talexander/organic.git"
+#   clone_uri = "git@code.fizz.buzz:talexander/organic.git"
-  skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
+#   skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
 
 [[push]]
   name = "foreign-document-test"
   source = "pipeline-foreign-document-test.yaml"
   clone_uri = "git@code.fizz.buzz:talexander/organic.git"
-  branches = [ "^main$", "^master$" ]
+  branches = [ "^main$", "^master$", "^no_add$" ]
 
-[[push]]
+# [[push]]
-  name = "clippy"
+#   name = "clippy"
-  source = "pipeline-rust-clippy.yaml"
+#   source = "pipeline-rust-clippy.yaml"
-  clone_uri = "git@code.fizz.buzz:talexander/organic.git"
+#   clone_uri = "git@code.fizz.buzz:talexander/organic.git"
-  skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
+#   skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
 
-[[push]]
+# [[push]]
-  name = "format"
+#   name = "format"
-  source = "pipeline-format.yaml"
+#   source = "pipeline-format.yaml"
-  clone_uri = "git@code.fizz.buzz:talexander/organic.git"
+#   clone_uri = "git@code.fizz.buzz:talexander/organic.git"
-  skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
+#   skip_branches = [ "^v[0-9]+\\.[0-9]+\\.[0-9]+$" ]
 
-[[push]]
+# [[push]]
-  name = "build"
+#   name = "build"
-  source = "pipeline-build-hash.yaml"
+#   source = "pipeline-build-hash.yaml"
-  clone_uri = "git@code.fizz.buzz:talexander/organic.git"
+#   clone_uri = "git@code.fizz.buzz:talexander/organic.git"
-  branches = [ "^main$", "^master$" ]
+#   branches = [ "^main$", "^master$" ]

Cargo.toml

@@ -1,5 +1,4 @@
 # cargo-features = ["profile-rustflags"]
-cargo-features = ["codegen-backend"]
 
 [package]
 name = "organic"
@@ -104,9 +103,5 @@ inherits = "release"
 lto = true
 strip = true
 
-[profile.dev]
-codegen-backend = "cranelift"
-
 [profile.dev.package."*"]
-codegen-backend = "llvm"
 opt-level = 3

build.rs

@@ -26,7 +26,7 @@ fn main() {
                 dir_entry.file_type().is_file()
                     && Path::new(dir_entry.file_name())
                         .extension()
-                        .map(|ext| ext.to_ascii_lowercase() == "org")
+                        .map(|ext| ext.eq_ignore_ascii_case("org"))
                         .unwrap_or(false)
             }
             Err(_) => true,

docker/organic_development/Dockerfile

@@ -1,7 +1,10 @@
-FROM rustlang/rust:nightly-alpine3.20 AS builder
+# syntax=docker/dockerfile:1
+ARG ALPINE_VERSION="3.20"
+
+FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS builder
 
 RUN apk add --no-cache musl-dev
-RUN cargo install --locked --no-default-features --features ci-autoclean cargo-cache
+RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked cargo install --locked --no-default-features --features ci-autoclean cargo-cache
 RUN rustup component add rustc-codegen-cranelift
 
 FROM builder AS format

docker/organic_test/Dockerfile

@@ -1,3 +1,6 @@
+# syntax=docker/dockerfile:1
+ARG ALPINE_VERSION="3.20"
+
 # ARG EMACS_REPO=https://git.savannah.gnu.org/git/emacs.git
 ARG EMACS_REPO=https://code.fizz.buzz/mirror/emacs.git
 
@@ -9,42 +12,56 @@ ARG ORG_MODE_REPO=https://code.fizz.buzz/mirror/org-mode.git
 ARG ORG_VERSION=abf5156096c06ee5aa05795c3dc5a065f76ada97
 
 
-FROM alpine:3.20 AS build
+FROM alpine:$ALPINE_VERSION AS build
 RUN apk add --no-cache build-base musl-dev git autoconf make texinfo gnutls-dev ncurses-dev gawk libgccjit-dev
 
 
 FROM build AS build-emacs
-ARG EMACS_VERSION
 ARG EMACS_REPO
-RUN git clone --depth 1 --branch $EMACS_VERSION $EMACS_REPO /root/emacs
+ARG EMACS_VERSION
+
+RUN <<EOF
+set -euo pipefail
+IFS=$'\n\t'
+mkdir -p /root/emacs
+git -C /root/emacs init --initial-branch=main
+git -C /root/emacs remote add origin $EMACS_REPO
+git -C /root/emacs fetch origin $EMACS_VERSION
+git -C /root/emacs checkout FETCH_HEAD
+EOF
+#ADD "$EMACS_REPO#$EMACS_VERSION" /root/emacs
 WORKDIR /root/emacs
-RUN mkdir /root/dist
+RUN <<EOF
-RUN ./autogen.sh
+mkdir /root/dist
-RUN ./configure --prefix /usr --without-x --without-sound --with-native-compilation=aot
+./autogen.sh
-RUN make
+./configure --prefix /usr --without-x --without-sound --with-native-compilation=aot
-RUN make DESTDIR="/root/dist" install
+make
+make DESTDIR="/root/dist" install
+EOF
 
 
 FROM build AS build-org-mode
 ARG ORG_VERSION
 ARG ORG_MODE_REPO
-COPY --from=build-emacs /root/dist/ /
+COPY --link --from=build-emacs /root/dist/ /
 RUN mkdir /root/dist
 # Savannah does not allow fetching specific revisions, so we're going to have to put unnecessary load on their server by cloning main and then checking out the revision we want.
 RUN git clone $ORG_MODE_REPO /root/org-mode && git -C /root/org-mode checkout $ORG_VERSION
 # RUN mkdir /root/org-mode && git -C /root/org-mode init --initial-branch=main && git -C /root/org-mode remote add origin $ORG_REPO && git -C /root/org-mode fetch origin $ORG_VERSION && git -C /root/org-mode checkout FETCH_HEAD
 WORKDIR /root/org-mode
-RUN make compile
+RUN <<EOF
-RUN make DESTDIR="/root/dist" install
+make compile
+make DESTDIR="/root/dist" install
+EOF
 
 
-FROM rustlang/rust:nightly-alpine3.20 AS tester
+FROM rustlang/rust:nightly-alpine$ALPINE_VERSION AS tester
 ENV LANG=en_US.UTF-8
 RUN apk add --no-cache musl-dev ncurses gnutls libgccjit
-RUN cargo install --locked --no-default-features --features ci-autoclean cargo-cache
+RUN --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked cargo install --locked --no-default-features --features ci-autoclean cargo-cache
 RUN rustup component add rustc-codegen-cranelift
-COPY --from=build-emacs /root/dist/ /
+COPY --link --from=build-emacs /root/dist/ /
-COPY --from=build-org-mode /root/dist/ /
+COPY --link --from=build-org-mode /root/dist/ /
 
 ENTRYPOINT ["cargo", "test"]
 
@@ -115,12 +132,14 @@ RUN mkdir -p $LITERATE_BUILD_EMACS_PATH && git -C $LITERATE_BUILD_EMACS_PATH ini
 RUN rm $LITERATE_BUILD_EMACS_PATH/unused/aws.org
 
 FROM tester as foreign-document
-RUN apk add --no-cache bash coreutils
+RUN <<EOF
-RUN mkdir /foreign_documents
+apk add --no-cache bash coreutils
-COPY --from=foreign-document-gather /foreign_documents/howardabrams /foreign_documents/howardabrams
+mkdir /foreign_documents
-COPY --from=foreign-document-gather /foreign_documents/doomemacs /foreign_documents/doomemacs
+EOF
-COPY --from=foreign-document-gather /foreign_documents/worg /foreign_documents/worg
+COPY --link --from=foreign-document-gather /foreign_documents/howardabrams /foreign_documents/howardabrams
-COPY --from=foreign-document-gather /foreign_documents/literate_build_emacs /foreign_documents/literate_build_emacs
+COPY --link --from=foreign-document-gather /foreign_documents/doomemacs /foreign_documents/doomemacs
-COPY --from=build-org-mode /root/org-mode /foreign_documents/org-mode
+COPY --link --from=foreign-document-gather /foreign_documents/worg /foreign_documents/worg
-COPY --from=build-emacs /root/emacs /foreign_documents/emacs
+COPY --link --from=foreign-document-gather /foreign_documents/literate_build_emacs /foreign_documents/literate_build_emacs
+COPY --link --from=build-org-mode /root/org-mode /foreign_documents/org-mode
+COPY --link --from=build-emacs /root/emacs /foreign_documents/emacs
 ENTRYPOINT ["cargo", "run", "--bin", "foreign_document_test", "--features", "compare,foreign_document_test", "--profile", "release-lto"]

flake.lock

@@ -0,0 +1,48 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1781407245,
+        "narHash": "sha256-VzJq4MmD0uyNDAceudSe1hHqcQMe9Tau0U4S+5iRGh0=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "d5f483210eb016d66102eef22baa128b3b3233fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,162 @@
+{
+  description = "Organic Org parser";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+      };
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      rust-overlay,
+    }:
+    let
+      forAllSystems =
+        func:
+        builtins.listToAttrs (
+          map (system: {
+            name = system;
+            value = func system;
+          }) nixpkgs.lib.systems.flakeExposed
+        );
+    in
+    {
+      devShells = forAllSystems (
+        system:
+        let
+          overlays = [ (import rust-overlay) ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+          rustToolchain = (pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml).override {
+            targets = [ "wasm32-unknown-unknown" ];
+          };
+        in
+        {
+          default = pkgs.mkShell {
+            nativeBuildInputs = [
+              rustToolchain
+            ];
+            buildInputs = with pkgs; [
+              wasm-bindgen-cli
+            ];
+          };
+        }
+      );
+      packages = forAllSystems (
+        system:
+        let
+          overlays = [ (import rust-overlay) ];
+          pkgs = import nixpkgs {
+            inherit system overlays;
+          };
+          appliedOverlay = self.overlays.default pkgs pkgs;
+        in
+        rec {
+          default = all;
+          all = pkgs.symlinkJoin {
+            name = "all";
+            paths = [
+              library
+              devTools
+              wasm_bundler
+              wasm_web
+            ];
+          };
+          inherit (appliedOverlay.organic)
+            library
+            devTools
+            wasm_bundler
+            wasm_web
+            ;
+          docker_env = pkgs.buildEnv {
+            name = "organic";
+            paths = with pkgs; [
+              appliedOverlay.organic.devTools
+              bash
+              uutils-coreutils-noprefix
+              # toybox # Smaller than uutils-coreutils?
+            ];
+          };
+        }
+      );
+      overlays.default = final: prev: {
+        organic = final.lib.makeScope final.newScope (
+          organicScope:
+          let
+            build_wasm =
+              {
+                bindgenTarget ? null,
+              }:
+              (organicScope.callPackage ./nix/package.nix {
+                inherit rust-overlay;
+                targetBins = [
+                  "wasm"
+                ];
+                features = [ "wasm" ];
+                cargoBuildTarget = "wasm32-unknown-unknown";
+                buildType = "wasm";
+              }).overrideAttrs
+                (
+                  old:
+                  let
+                    bindgen_command = [
+                      "${final.wasm-bindgen-cli}/bin/wasm-bindgen"
+                      "--target"
+                      bindgenTarget
+                      "--out-dir"
+                      "target/wasm32-unknown-unknown/${bindgenTarget}"
+                      "target/wasm32-unknown-unknown/wasm/wasm.wasm"
+                    ];
+                  in
+                  {
+                    postBuild = ''
+                      ${final.lib.escapeShellArgs bindgen_command}
+                    '';
+
+                    installPhase = ''
+                      mkdir -p $out/share/${bindgenTarget}
+                      cp target/wasm32-unknown-unknown/${bindgenTarget}/* $out/share/${bindgenTarget}
+                    '';
+                  }
+                );
+          in
+          {
+            library =
+              (organicScope.callPackage ./nix/package.nix {
+                inherit rust-overlay;
+                buildLib = true;
+              }).overrideAttrs
+                (
+                  old:
+                  let
+                  in
+                  {
+                    installPhase = ''
+                      mkdir -p $out/lib
+                      cp target/*/release/liborganic.rlib $out/lib/
+                    '';
+                  }
+                );
+            devTools = organicScope.callPackage ./nix/package.nix {
+              inherit rust-overlay;
+              targetBins = [
+                "parse"
+                "compare"
+              ];
+              features = [ "compare" ];
+            };
+            wasm_bundler = build_wasm { bindgenTarget = "bundler"; };
+            wasm_web = build_wasm { bindgenTarget = "web"; };
+          }
+        );
+      };
+    };
+}

nix/package.nix

@@ -0,0 +1,82 @@
+{
+  hello,
+  lib,
+  pkgs,
+  rust-overlay,
+
+  targetBins ? [ ],
+  features ? [ ],
+  cargoBuildTarget ? null,
+  buildType ? null,
+  buildLib ? false,
+}:
+let
+  cargoToml = (lib.importTOML ../Cargo.toml);
+  rustPlatformFor =
+    pkgs:
+    let
+      rust-bin = rust-overlay.lib.mkRustBin { } pkgs;
+      rustToolchain = (rust-bin.fromRustupToolchainFile ../rust-toolchain.toml).override (
+        if cargoBuildTarget != null then
+          {
+            targets = [ cargoBuildTarget ];
+          }
+        else
+          { }
+      );
+      baseRustPlatform = (
+        pkgs.makeRustPlatform {
+          cargo = rustToolchain;
+          rustc = rustToolchain;
+        }
+      );
+      rustPlatform =
+        if cargoBuildTarget != null then
+          baseRustPlatform.overrideScope (
+            final: prev: {
+              cargoBuildHook = prev.cargoBuildHook.overrideDerivation (_: {
+                rustcTargetSpec = cargoBuildTarget;
+              });
+              cargoInstallHook = hello;
+            }
+          )
+        else
+          baseRustPlatform;
+    in
+    rustPlatform;
+in
+(rustPlatformFor pkgs).buildRustPackage (
+  # rustPlatform.buildRustPackage (
+  {
+    pname = "organic";
+    version = cargoToml.package.version;
+    src = lib.cleanSource ../.;
+
+    cargoLock.lockFile = ../Cargo.lock;
+
+    cargoBuildFlags = builtins.concatLists [
+      (builtins.concatMap (targetBin: [
+        "--bin"
+        targetBin
+      ]) targetBins)
+      (if buildLib then [ "--lib" ] else [ ])
+      (
+        if features != [ ] then
+          [
+            "--features"
+            (builtins.concatStringsSep " " features)
+          ]
+        else
+          [ ]
+      )
+    ];
+  }
+  // (
+    if buildType != null then
+      {
+        buildType = buildType;
+      }
+    else
+      { }
+  )
+)

org_mode_samples/object/regular_link/jump_to_line_number.org

@@ -0,0 +1 @@
+[[file:simple.org::2]]

org_mode_samples/object/regular_link/tramp_link.org

@@ -0,0 +1 @@
+[[/ssh:admin@test.example:important/file.pdf]]

rust-toolchain.toml

@@ -0,0 +1,4 @@
+[toolchain]
+channel = "nightly-2026-05-23"
+profile = "default"
+components = ["clippy", "rustfmt"]