From 6d892db8b7233d3fb2222f67ce3b2b693577a9cd Mon Sep 17 00:00:00 2001
From: "prompt.ac/@jeffrey" <mail@aesthetic.computer>
Date: Fri, 10 Apr 2026 13:05:52 -0700
Subject: [PATCH] fix(oven): freeze native release metadata

---
 fedac/native/scripts/upload-release.sh |  9 +++++----
 oven/native-builder.mjs                | 11 +++++++++--
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/fedac/native/scripts/upload-release.sh b/fedac/native/scripts/upload-release.sh
index c90970354a..4fffc9afdf 100755
--- a/fedac/native/scripts/upload-release.sh
+++ b/fedac/native/scripts/upload-release.sh
@@ -67,7 +67,7 @@ if [ -n "$GIT_ROOT" ]; then
   GIT_CWD="$GIT_ROOT"
   GIT_NATIVE_PATHS=(fedac/native fedac/nixos)
 fi
-GIT_HASH=$(git -C "$GIT_CWD" rev-parse --short HEAD 2>/dev/null || echo "unknown")
+GIT_HASH="${AC_GIT_HASH:-$(git -C "$GIT_CWD" rev-parse --short HEAD 2>/dev/null || echo "unknown")}"
 CONFLICT_FILES=$(git -C "$GIT_CWD" diff --name-only --diff-filter=U -- "${GIT_NATIVE_PATHS[@]}" 2>/dev/null || true)
 if [ -n "$CONFLICT_FILES" ]; then
   echo "Error: refusing upload with unresolved merge conflicts:" >&2
@@ -87,7 +87,7 @@ fi
 if [ "$DIRTY_TRACKED" -eq 1 ]; then
   GIT_HASH="${GIT_HASH}-dirty"
 fi
-BUILD_TS=$(date -u '+%Y-%m-%dT%H:%M')
+BUILD_TS="${AC_BUILD_TS:-$(date -u '+%Y-%m-%dT%H:%M')}"
 # Format must match AC_GIT_HASH "-" AC_BUILD_TS in js-bindings.c / Makefile
 VERSION="${GIT_HASH}-${BUILD_TS}"
 
@@ -187,7 +187,7 @@ curl -sf "${BASE_URL}/os/${CHANNEL_PREFIX}releases.json" -o "$RELEASES_JSON" 2>/
   || echo '{"releases":[]}' > "$RELEASES_JSON"
 
 # Append new entry (keep last 50)
-COMMIT_MSG=$(git -C "$GIT_CWD" log -1 --format="%s" 2>/dev/null || echo "")
+COMMIT_MSG="${AC_COMMIT_MSG:-$(git -C "$GIT_CWD" log -1 --format="%s" 2>/dev/null || echo "")}"
 BUILD_HANDLE="${AC_HANDLE:-}"
 
 python3 - "$RELEASES_JSON" "$FULL_VERSION" "$SHA256" "$SIZE" "$GIT_HASH" "$BUILD_TS" "$BUILD_NAME" "$CHANNEL_PREFIX" "$COMMIT_MSG" "$BUILD_HANDLE" <<'PYEOF'
@@ -219,7 +219,8 @@ do_upload "$RELEASES_JSON" "os/${CHANNEL_PREFIX}releases.json" "application/json
 
 # Record build in MongoDB
 if command -v node &>/dev/null; then
-  echo "{\"name\":\"$BUILD_NAME\",\"buildNum\":$BUILD_NUM,\"version\":\"$FULL_VERSION\",\"sha256\":\"$SHA256\",\"size\":$SIZE,\"git_hash\":\"$GIT_HASH\",\"build_ts\":\"$BUILD_TS\",\"url\":\"${BASE_URL}/os/native-notepat-latest.vmlinuz\"}" \
+  BUILD_NUM_JSON="${BUILD_NUM:-null}"
+  echo "{\"name\":\"$BUILD_NAME\",\"buildNum\":$BUILD_NUM_JSON,\"version\":\"$FULL_VERSION\",\"sha256\":\"$SHA256\",\"size\":$SIZE,\"git_hash\":\"$GIT_HASH\",\"build_ts\":\"$BUILD_TS\",\"url\":\"${BASE_URL}/os/native-notepat-latest.vmlinuz\"}" \
     | node "$SCRIPT_DIR/track-build.mjs" record 2>&1 || true
 fi
 
diff --git a/oven/native-builder.mjs b/oven/native-builder.mjs
index efba30aee2..f77d735f59 100644
--- a/oven/native-builder.mjs
+++ b/oven/native-builder.mjs
@@ -417,8 +417,12 @@ async function runBuildJob(job) {
     }
 
     const buildName = await runSync("bash", ["scripts/build-name.sh"], NATIVE_DIR) || `oven-${job.ref.slice(0, 7)}`;
+    const buildGitHash = await runSync("git", ["rev-parse", "--short", "HEAD"], repoDir) || job.ref.slice(0, 9);
+    const buildTs = new Date().toISOString().slice(0, 16);
     const commitMsg = await runSync("git", ["log", "-1", "--format=%s", job.ref], repoDir) || "";
     job.buildName = buildName;
+    job.buildGitHash = buildGitHash;
+    job.buildTs = buildTs;
     job.commitMsg = commitMsg;
     const vmlinuzOut = `/tmp/oven-vmlinuz-${job.id}`;
 
@@ -457,6 +461,9 @@ async function runBuildJob(job) {
       DO_SPACES_KEY: process.env.DO_SPACES_KEY || process.env.ART_SPACES_KEY || "",
       DO_SPACES_SECRET: process.env.DO_SPACES_SECRET || process.env.ART_SPACES_SECRET || "",
       AC_BUILD_NAME: buildName,
+      AC_GIT_HASH: buildGitHash,
+      AC_BUILD_TS: buildTs,
+      AC_COMMIT_MSG: commitMsg,
     };
 
     // ── C variant ──
@@ -464,7 +471,7 @@ async function runBuildJob(job) {
       addLogLine(job, "stdout", "Phase 2: Compiling C kernel in Docker...");
       const cidFile = `/tmp/oven-cid-${job.id}`;
       await runPhase(job, "build", "bash", ["-c", [
-        `CID=$(docker create -e AC_BUILD_NAME=${buildName} -v ac-os-ccache:/ccache ac-os-builder)`,
+        `CID=$(docker create -e AC_BUILD_NAME=${buildName} -e AC_GIT_HASH=${buildGitHash} -e AC_BUILD_TS=${buildTs} -v ac-os-ccache:/ccache ac-os-builder)`,
         `echo $CID > ${cidFile}`,
         `docker start -a $CID`,
       ].join(" && ")], repoDir);
@@ -515,7 +522,7 @@ async function runBuildJob(job) {
       const clVmlinuzOut = `/tmp/oven-cl-vmlinuz-${job.id}`;
 
       await runPhase(job, "cl-build", "bash", ["-c", [
-        `CID=$(docker create -e AC_BUILD_NAME=${buildName} -e AC_BUILD_VARIANT=cl -e AC_BUILD_LISP=1 ac-os-builder)`,
+        `CID=$(docker create -e AC_BUILD_NAME=${buildName} -e AC_GIT_HASH=${buildGitHash} -e AC_BUILD_TS=${buildTs} -e AC_BUILD_VARIANT=cl -e AC_BUILD_LISP=1 ac-os-builder)`,
         `echo $CID > ${clCidFile}`,
         `docker start -a $CID`,
       ].join(" && ")], repoDir);
-- 
2.54.0