From 1518c309ee3e38038199a9f2b73754e99f28dc58 Mon Sep 17 00:00:00 2001 From: zzstoatzz Date: Sun, 9 Aug 2026 15:57:11 -0500 Subject: [PATCH] admission.yml: extract zig into the workspace, not /opt MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NixOS has no /opt; tar's 'cannot open' is a fatal exit 2, which is exactly the failure every run has shown since 2026-08-07. ci.yml has always extracted into /tangled/workspace — the working example was one directory away the whole time. Also bootstraps the strict power-loss image, which admit run requires and CI has never had. Probes proved the engine, image, dependency list and virtualisation.docker are all fine, so this was the remaining difference. Co-Authored-By: Claude Fable 5 --- .tangled/workflows/admission.yml | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/.tangled/workflows/admission.yml b/.tangled/workflows/admission.yml index 3f10ac1..c762cfc 100644 --- a/.tangled/workflows/admission.yml +++ b/.tangled/workflows/admission.yml @@ -37,8 +37,14 @@ steps: - name: toolchain command: | set -euo pipefail - curl -fSL https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz | tar xJ -C /opt - echo 'export PATH=/opt/zig-x86_64-linux-0.16.0:$PATH' > /tmp/env.sh + # Extract into the workspace, which exists and persists across steps. + # NixOS has no /opt, and tar's "cannot open" is a FATAL exit 2 — the + # entire reason every run since 2026-08-07 died in ~20s (ci.yml has + # always done it this way). + curl -fSL https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz | + tar xJ -C /tangled/workspace + mv /tangled/workspace/zig-x86_64-linux-0.16.0 /tangled/workspace/.zig + /tangled/workspace/.zig/zig version modprobe nbd || true # powerloss oracle's containerized NBD device - name: upstream clone at pin @@ -55,10 +61,18 @@ steps: nohup go run ./cmd/simulator serve --reset --accounts=100 --commits-per-sec=20 >/tmp/sim.log 2>&1 & until curl -s http://127.0.0.1:7777/ >/dev/null 2>&1; do sleep 2; done + - name: strict power-loss image + command: | + set -euo pipefail + # One-time networked bootstrap the powerloss suite requires; the run + # itself is offline. Cheap here, and its absence fails admit run. + export PATH=/tangled/workspace/.zig:$PATH + just powerloss-image + - name: admission (suites + local native image + receipt) command: | set -euo pipefail - source /tmp/env.sh + export PATH=/tangled/workspace/.zig:$PATH printf '%s' "$ATCR_APP_PASSWORD" | docker login atcr.io -u zat.dev --password-stdin || true ./scripts/admit run @@ -69,7 +83,7 @@ steps: # (an over-quota account denies every write scope). That must not # discard a passing gate: the receipt already binds the local image id, # and `admit publish` can pin the registry digest later. - source /tmp/env.sh + export PATH=/tangled/workspace/.zig:$PATH ./scripts/admit publish || echo "WARN: publish failed; receipt keeps its local image id" - name: emit receipt -- 2.51.2