cut: build the release with the official zig tarball, skip hidden bundle files; re-pin 0.0.17

The first 0.0.17 cut (run 687) failed verify-pins in CI for two reasons. The asset generator embedded admin/dist/.src-hash, a freshness stamp that CI's artifact copy does not carry; it now skips dotfiles. And the Arch zig package emits different code than the ziglang.org tarball that CI installs, so the cut downloads the pinned tarball (ZIG_TARBALL_SHA256 in gates.yml, the full digest keys the cache) and builds the release with it. flake.nix is re-pinned to the bytes both now produce. The saturated-primary pool test gates its holders on a semaphore instead of sleeps and releases every spawned holder on the way out, so a loaded runner cannot flake it. The package job uploads the payload before the pin check and runs the check when the version or flake.nix changed against the parent. The verify-a-release recipe clones the tag first and builds with the official zig.
2026-09-08 23:57:07 +02:00
parent d596fd788a
commit f168247b33
10 changed files with 348 additions and 92 deletions
@@ -102,6 +102,11 @@ fn collectSorted(arena: Allocator, io: std.Io, dist: std.Io.Dir) ![]const []cons
    defer walker.deinit();
    while (try walker.next(io)) |entry| {
        if (entry.kind != .file) continue;
+        // A hidden file is build metadata, not a web asset: the freshness stamp
+        // `admin/dist/.src-hash` exists in a local tree and not in a bundle that
+        // went through a CI artifact round trip, and embedding it would make the
+        // two binaries differ.
+        if (entry.basename.len != 0 and entry.basename[0] == '.') continue;
        for (entry.path) |c| {
            if (!std.ascii.isAlphanumeric(c) and std.mem.findScalar(u8, "._-/", c) == null) {
                std.process.fatal("asset name '{s}' has a character the index cannot carry", .{entry.path});
@@ -231,3 +236,23 @@ fn renderIndex(arena: Allocator, assets: []const Asset) ![]const u8 {
    try w.writeAll("};\n");
    return sink.written();
 }
+
+const testing = std.testing;
+
+test "a hidden file is not indexed" {
+    const io = testing.io;
+
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+
+    var tmp = testing.tmpDir(.{ .iterate = true });
+    defer tmp.cleanup();
+
+    try tmp.dir.writeFile(io, .{ .sub_path = "index.html", .data = "<!doctype html>" });
+    try tmp.dir.writeFile(io, .{ .sub_path = ".src-hash", .data = "deadbeef" });
+
+    const names = try collectSorted(arena, io, tmp.dir);
+    try testing.expectEqual(@as(usize, 1), names.len);
+    try testing.expectEqualStrings("index.html", names[0]);
+}