cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17

The first 0.0.17 cut (run 687) failed verify-pins in CI for two reasons. The asset generator embedded admin/dist/.src-hash, a freshness stamp that CI's artifact copy does not carry; it now skips dotfiles. And the Arch zig package emits different code than the ziglang.org tarball that CI installs, so the cut downloads the pinned tarball (ZIG_TARBALL_SHA256 in gates.yml, the full digest keys the cache) and builds the release with it. flake.nix is re-pinned to the bytes both now produce.

The saturated-primary pool test gates its holders on a semaphore instead of sleeps and releases every spawned holder on the way out, so a loaded runner cannot flake it. The package job uploads the payload before the pin check and runs the check when the version or flake.nix changed against the parent. The verify-a-release recipe clones the tag first and builds with the official zig.

.gitea/workflows/gates.yml

@@ -41,6 +41,12 @@ on:
 
 env:
   ZIG_VERSION: "0.16.0"
+  # The bytes of that zig, not just its version string: a distribution package
+  # of the same version is built against a different LLVM and emits different
+  # machine code, so its tarballs hash to something no CI run reproduces.
+  # setup-zig verifies these same bytes by minisign; `zig build cut` checks this
+  # digest before it builds a release.
+  ZIG_TARBALL_SHA256: "70e49664a74374b48b51e6f3fdfbf437f6395d42509050588bd49abe52ba3d00"
   # Exact patch, not a floating "24" (milestone-14 ruling 12): the bundled npm
   # and the emitted bundle change under a floating major.
   NODE_VERSION: "24.19.0"
@@ -287,52 +293,11 @@ jobs:
             -Dadmin-dist=admin-dist-ci \
             -Doptimize=ReleaseSafe
 
-      # The cut writes the release hashes into flake.nix before it makes the
-      # bump commit, so the bump commit is the one commit whose pins nothing has
-      # verified yet — the tag's own run (release.yml) is the next chance, and by
-      # then the tag is public. This step is that first chance.
+      # This upload runs before the pin check below: a pin mismatch is exactly
+      # the failure whose diagnosis needs the built bytes, so they must already
+      # be downloadable when that step fails. The container job's dependency on
+      # the artifact is unchanged.
       #
-      # It is deliberately NOT part of verify-dist. Every other commit on master
-      # builds the same build.zig.zon version from a different tree, so its bytes
-      # legitimately differ from the pins and a check there would fail the whole
-      # branch. The commit is identified by the version it declares, not by its
-      # message: a message is a string anyone can write, and the pins follow
-      # the manifest.
-      #
-      # A root commit has no first parent. That is an error rather than a skip:
-      # this repository has history, so `HEAD^` failing means the checkout is
-      # shallower than the depth 2 declared above and the question went
-      # unanswered, which must never read as "nothing to check".
-      #
-      # The predicate is the declared VERSION, not the file: build.zig.zon also
-      # carries the dependency pins, and updating a sqlite or mbedTLS hash
-      # changes the file without cutting a release. Such a commit builds the
-      # same version from a different tree, so its bytes are not the pinned
-      # ones and this check would fail it.
-      #
-      # HEAD's version is CI_VERSION, parsed out of the working tree by the
-      # container gate tool. The parent's is read with `sed`, because that tool
-      # reads `build.zig.zon` at a fixed path and has no mode for a blob out of
-      # history. An empty parse is a failure, not a bump: it means the manifest
-      # moved and the question went unanswered.
-      - name: Verify the flake pins on a version bump
-        run: |
-          set -euo pipefail
-          parent="$(git rev-parse --verify HEAD^)"
-          parent_version="$(git show "$parent":build.zig.zon | sed -n 's/^[[:space:]]*\.version = "\([^"]*\)".*/\1/p')"
-          if [ -z "$parent_version" ]; then
-            echo "cannot read .version out of $parent:build.zig.zon" >&2
-            exit 1
-          fi
-          if [ "$parent_version" != "$CI_VERSION" ]; then
-            zig build verify-pins \
-              -Dversion-string="$CI_VERSION" \
-              -Dadmin-dist=admin-dist-ci \
-              -Doptimize=ReleaseSafe
-          else
-            echo "skipped: $GITHUB_SHA declares version $CI_VERSION and $parent already declared $parent_version, so it is not a version bump and its bytes are not the ones flake.nix pins"
-          fi
-
       # deploy/docker/Dockerfile copies both of these trees and nothing else
       # out of zig-out/dist: the binary comes from dist/bin/<triple>/, and
       # /LICENSE and /THIRD-PARTY-NOTICES come from the matching dist/stage/
@@ -360,6 +325,57 @@ jobs:
             zig-out/bin/container_check
           if-no-files-found: error
 
+      # The cut writes the release hashes into flake.nix before it makes the
+      # bump commit, so the bump commit is the one commit whose pins nothing has
+      # verified yet — the tag's own run (release.yml) is the next chance, and by
+      # then the tag is public. This step is that first chance.
+      #
+      # It is deliberately NOT part of verify-dist. Every other commit on master
+      # builds the same build.zig.zon version from a different tree, so its bytes
+      # legitimately differ from the pins and a check there would fail the whole
+      # branch. The commit is identified by the version it declares, not by its
+      # message: a message is a string anyone can write, and the pins follow
+      # the manifest.
+      #
+      # A root commit has no first parent. That is an error rather than a skip:
+      # this repository has history, so `HEAD^` failing means the checkout is
+      # shallower than the depth 2 declared above and the question went
+      # unanswered, which must never read as "nothing to check".
+      #
+      # The predicate is the declared VERSION, not the file: build.zig.zon also
+      # carries the dependency pins, and updating a sqlite or mbedTLS hash
+      # changes the file without cutting a release. Such a commit builds the
+      # same version from a different tree, so its bytes are not the pinned
+      # ones and this check would fail it.
+      #
+      # A commit that rewrites flake.nix runs the check too: a re-pin during a
+      # cut changes the pins without changing the version, and those pins must
+      # be verified before the tag as well.
+      #
+      # HEAD's version is CI_VERSION, parsed out of the working tree by the
+      # container gate tool. The parent's is read with `sed`, because that tool
+      # reads `build.zig.zon` at a fixed path and has no mode for a blob out of
+      # history. An empty parse is a failure, not a bump: it means the manifest
+      # moved and the question went unanswered.
+      - name: Verify the flake pins on a version bump
+        run: |
+          set -euo pipefail
+          parent="$(git rev-parse --verify HEAD^)"
+          parent_version="$(git show "$parent":build.zig.zon | sed -n 's/^[[:space:]]*\.version = "\([^"]*\)".*/\1/p')"
+          if [ -z "$parent_version" ]; then
+            echo "cannot read .version out of $parent:build.zig.zon" >&2
+            exit 1
+          fi
+          if [ "$parent_version" != "$CI_VERSION" ] || ! git diff --quiet "$parent" HEAD -- flake.nix; then
+            zig build verify-pins \
+              -Dversion-string="$CI_VERSION" \
+              -Dadmin-dist=admin-dist-ci \
+              -Doptimize=ReleaseSafe
+          else
+            echo "skipped: $GITHUB_SHA declares version $CI_VERSION, $parent already declared $parent_version and flake.nix is unchanged, so it is neither a version bump nor a re-pin and its bytes are not the ones flake.nix pins"
+          fi
+
+
   container:
     needs: [package]
     runs-on: ubuntu-24.04