From 0d32adaba8e6461a64f0ebe50bd1b5c4a81990f2 Mon Sep 17 00:00:00 2001 From: John McBride Date: Thu, 13 Aug 2026 14:54:49 -0500 Subject: [PATCH 1/5] chore: bump Dagger to 0.21.8 --- .github/workflows/ci.yaml | 6 +++--- .github/workflows/cut-release.yaml | 4 ++-- .github/workflows/nightly.yaml | 4 ++-- .github/workflows/pr.yaml | 6 +++--- .github/workflows/release.yaml | 4 ++-- dagger.json | 2 +- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index bab6849..56774b6 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -23,7 +23,7 @@ permissions: contents: read env: - DAGGER_VERSION: "0.21.7" + DAGGER_VERSION: "0.21.8" concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -39,7 +39,7 @@ jobs: uses: actions/checkout@v4 - name: Install Dagger - uses: dagger/dagger-for-github@v8.2.0 + uses: dagger/dagger-for-github@v8.4.1 with: version: ${{ env.DAGGER_VERSION }} @@ -140,7 +140,7 @@ jobs: uses: actions/checkout@v4 - name: Cross-compile all targets via Dagger - uses: dagger/dagger-for-github@v8.2.0 + uses: dagger/dagger-for-github@v8.4.1 env: DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }} with: diff --git a/.github/workflows/cut-release.yaml b/.github/workflows/cut-release.yaml index ca905a0..f5af585 100644 --- a/.github/workflows/cut-release.yaml +++ b/.github/workflows/cut-release.yaml @@ -7,7 +7,7 @@ permissions: contents: write env: - DAGGER_VERSION: "0.21.7" + DAGGER_VERSION: "0.21.8" jobs: create-release: @@ -28,7 +28,7 @@ jobs: private-key: ${{ secrets.PAPER_COMPUTE_CO_BOT_PRIVATE_KEY }} - name: Install Dagger - uses: dagger/dagger-for-github@v8.2.0 + uses: dagger/dagger-for-github@v8.4.1 with: version: ${{ env.DAGGER_VERSION }} diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 3993ef1..0a106b0 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -9,7 +9,7 @@ permissions: contents: write env: - DAGGER_VERSION: "0.21.7" + DAGGER_VERSION: "0.21.8" jobs: check: @@ -53,7 +53,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Dagger - uses: dagger/dagger-for-github@v8.2.0 + uses: dagger/dagger-for-github@v8.4.1 with: version: ${{ env.DAGGER_VERSION }} diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index eb62255..3e963e8 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -17,7 +17,7 @@ permissions: pull-requests: read env: - DAGGER_VERSION: "0.21.7" + DAGGER_VERSION: "0.21.8" concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -33,7 +33,7 @@ jobs: uses: actions/checkout@v4 - name: Install Dagger - uses: dagger/dagger-for-github@v8.2.0 + uses: dagger/dagger-for-github@v8.4.1 with: version: ${{ env.DAGGER_VERSION }} @@ -76,7 +76,7 @@ jobs: - name: Install Dagger if: github.event.pull_request.head.repo.full_name == github.repository - uses: dagger/dagger-for-github@v8.2.0 + uses: dagger/dagger-for-github@v8.4.1 with: version: ${{ env.DAGGER_VERSION }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d9ec546..76e4418 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -5,7 +5,7 @@ on: types: [published] env: - DAGGER_VERSION: "0.21.7" + DAGGER_VERSION: "0.21.8" jobs: release: @@ -18,7 +18,7 @@ jobs: uses: actions/checkout@v4 - name: Install Dagger - uses: dagger/dagger-for-github@v8.2.0 + uses: dagger/dagger-for-github@v8.4.1 with: version: ${{ env.DAGGER_VERSION }} diff --git a/dagger.json b/dagger.json index 4df6fbf..a84c40e 100644 --- a/dagger.json +++ b/dagger.json @@ -1,6 +1,6 @@ { "name": "tapesctl", - "engineVersion": "v0.21.7", + "engineVersion": "v0.21.8", "sdk": { "source": "go" }, From 381b645b04a266253aa1f9f8d34ea1377cfa4594 Mon Sep 17 00:00:00 2001 From: John McBride Date: Thu, 13 Aug 2026 16:06:21 -0500 Subject: [PATCH 2/5] chore: manage Dagger via Nix flake (0.21.8) --- .github/workflows/cut-release.yaml | 14 ++++++-------- .github/workflows/pr.yaml | 26 +++++++++++++------------- flake.lock | 6 +++--- 3 files changed, 22 insertions(+), 24 deletions(-) diff --git a/.github/workflows/cut-release.yaml b/.github/workflows/cut-release.yaml index f5af585..7ba534f 100644 --- a/.github/workflows/cut-release.yaml +++ b/.github/workflows/cut-release.yaml @@ -6,9 +6,6 @@ on: permissions: contents: write -env: - DAGGER_VERSION: "0.21.8" - jobs: create-release: name: Cut New GitHub Release @@ -27,14 +24,15 @@ jobs: app-id: ${{ secrets.PAPER_COMPUTE_CO_BOT_APP_ID }} private-key: ${{ secrets.PAPER_COMPUTE_CO_BOT_PRIVATE_KEY }} - - name: Install Dagger - uses: dagger/dagger-for-github@v8.4.1 - with: - version: ${{ env.DAGGER_VERSION }} + - name: Install Nix + uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8 + + - name: Cache Nix store + uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 - name: Create release via ghrelease run: | - dagger call -m github.com/papercomputeco/daggerverse/ghrelease \ + nix develop --command dagger call -m github.com/papercomputeco/daggerverse/ghrelease@45e997aec734ec4875ff57bebed2317e1bd49185 \ --token=env://GH_TOKEN \ with-repo \ --repo="${{ github.repository }}" \ diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 3e963e8..e129807 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -16,9 +16,6 @@ permissions: contents: read pull-requests: read -env: - DAGGER_VERSION: "0.21.8" - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true @@ -32,14 +29,15 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 - - name: Install Dagger - uses: dagger/dagger-for-github@v8.4.1 - with: - version: ${{ env.DAGGER_VERSION }} + - name: Install Nix + uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8 + + - name: Cache Nix store + uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 - name: Check PR title conformance run: | - dagger call -m github.com/papercomputeco/daggerverse/ghcontrib \ + nix develop --command dagger call -m github.com/papercomputeco/daggerverse/ghcontrib@45e997aec734ec4875ff57bebed2317e1bd49185 \ --token=env://GH_TOKEN \ --repo="${{ github.repository }}" \ check-pull-request \ @@ -74,16 +72,18 @@ jobs: if: github.event.pull_request.head.repo.full_name == github.repository uses: actions/checkout@v4 - - name: Install Dagger + - name: Install Nix + if: github.event.pull_request.head.repo.full_name == github.repository + uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8 + + - name: Cache Nix store if: github.event.pull_request.head.repo.full_name == github.repository - uses: dagger/dagger-for-github@v8.4.1 - with: - version: ${{ env.DAGGER_VERSION }} + uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 - name: Check Linear magic word if: github.event.pull_request.head.repo.full_name == github.repository run: | - dagger call -m github.com/papercomputeco/daggerverse/ghcontrib \ + nix develop --command dagger call -m github.com/papercomputeco/daggerverse/ghcontrib@45e997aec734ec4875ff57bebed2317e1bd49185 \ --token=env://GH_TOKEN \ --repo="${{ github.repository }}" \ check-pull-request-linear-magic-word \ diff --git a/flake.lock b/flake.lock index 3488cb6..e92b826 100644 --- a/flake.lock +++ b/flake.lock @@ -7,11 +7,11 @@ ] }, "locked": { - "lastModified": 1781718180, - "narHash": "sha256-olV0eG2YQlocEIgYl/zoeXn9BYVog3oq13dwhQi3BXw=", + "lastModified": 1785344846, + "narHash": "sha256-E0v8IiF9sEWNw615Yae1RH8KtMuOOF+mcafu2m0kHyE=", "owner": "dagger", "repo": "nix", - "rev": "c93d69f685b8a58eaa767eaaf189b0ac6f4f741a", + "rev": "b35b2b5ab62ace3a3c1e779c497de1ad762a4aa1", "type": "github" }, "original": { From 7c251ea8f526ab049cf53780b737e763b99d1fba Mon Sep 17 00:00:00 2001 From: John McBride Date: Thu, 13 Aug 2026 16:07:39 -0500 Subject: [PATCH 3/5] chore: convert CI workflow to Nix-managed Dagger --- .github/workflows/ci.yaml | 56 +++++++++++++++++++++++++++++---------- 1 file changed, 42 insertions(+), 14 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 56774b6..f78b6cf 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -22,9 +22,6 @@ on: permissions: contents: read -env: - DAGGER_VERSION: "0.21.8" - concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true @@ -38,18 +35,19 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 - - name: Install Dagger - uses: dagger/dagger-for-github@v8.4.1 - with: - version: ${{ env.DAGGER_VERSION }} + - name: Install Nix + uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8 + + - name: Cache Nix store + uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 - name: Lint (cargo fmt --check + clippy) - run: dagger call lint + run: nix develop --command dagger call lint env: DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }} - name: Test (cargo test --workspace) - run: dagger call test + run: nix develop --command dagger call test env: DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }} @@ -139,14 +137,21 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + # `--commit` and no `--version`: this is not a release, so the binaries + # report a development version — but they still say which commit produced + # them, which is what makes a downloaded CI artifact identifiable. The + # commit has to be passed in because the Dagger module builds from a + # source directory with no `.git` in it. + - name: Install Nix + uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8 + + - name: Cache Nix store + uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 + - name: Cross-compile all targets via Dagger - uses: dagger/dagger-for-github@v8.4.1 env: DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }} - with: - verb: call - args: build export --path=./build - version: ${{ env.DAGGER_VERSION }} + run: nix develop --command dagger call build --commit=${{ github.sha }} export --path=./build - name: Upload darwin arm64 binary uses: actions/upload-artifact@v4 @@ -229,3 +234,26 @@ jobs: set -e test "$bare_status" -eq 2 grep -q '^Usage: tapesctl' bare.txt + + # Every binary this project ships used to report the workspace manifest's + # version, which no release has ever bumped, so `--version` answered + # `0.1.0` from the first build to the latest release. This asserts the + # replacement on the artifact rather than in a unit test: the identity is + # injected by the build pipeline, so only something holding a built binary + # can tell whether the injection actually arrived. + # + # A CI build is stamped with the commit and no release tag, so the version + # is the development one — the release tag is asserted in release.yaml, + # against a released binary. + - name: Version reports the commit the binary was built from + env: + COMMIT: ${{ github.sha }} + run: | + ./bin/tapesctl version | tee version.txt + grep -qx "tapesctl 0.0.0-dev+${COMMIT:0:7}" version.txt + grep -qx "Sha: ${COMMIT}" version.txt + # `--version` and the `version` command are two ways of asking one + # question, and they print the same block: the command adds only the + # canary, so dropping it leaves exactly the flag's output. + ./bin/tapesctl --version > flag.txt + sed '$d' version.txt | diff - flag.txt From 232cb7c8bc6b5738fc1e6368e5064daf18afb48c Mon Sep 17 00:00:00 2001 From: John McBride Date: Thu, 13 Aug 2026 16:08:05 -0500 Subject: [PATCH 4/5] chore: convert release workflow to Nix-managed Dagger --- .github/workflows/release.yaml | 48 +++++++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 9 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 76e4418..9ce3986 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -4,9 +4,6 @@ on: release: types: [published] -env: - DAGGER_VERSION: "0.21.8" - jobs: release: runs-on: depot-ubuntu-24.04 @@ -17,16 +14,28 @@ jobs: - name: Checkout uses: actions/checkout@v4 - - name: Install Dagger - uses: dagger/dagger-for-github@v8.4.1 - with: - version: ${{ env.DAGGER_VERSION }} + - name: Install Nix + uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8 + + - name: Cache Nix store + uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 + # `--version` and `--commit` are what a released binary answers + # `tapesctl version` with. They have to be passed in: the Dagger module + # builds from a source directory with no `.git` in it, so nothing inside + # the build can work out which tag or commit it is compiling. + # + # This step publishes. `release-latest` syncs to the download prefixes + # `install.sh` reads, and it asks the built binary who it is before it + # syncs anything — so a build that lost its identity fails here with + # nothing uploaded, rather than being caught by a later step that can no + # longer take it back. - name: Build and upload release artifacts run: | - dagger call \ + nix develop --command dagger call \ release-latest \ --version="${{ github.event.release.tag_name }}" \ + --commit="${{ github.sha }}" \ --endpoint=env://BUCKET_ENDPOINT \ --bucket=env://BUCKET_NAME \ --access-key-id=env://BUCKET_ACCESS_KEY_ID \ @@ -40,9 +49,30 @@ jobs: BUCKET_SECRET_ACCESS_KEY: ${{ secrets.BUCKET_SECRET_ACCESS_KEY }} DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }} + # A second opinion, not the gate. The gate is inside the pipeline above, + # which is the only place the artifacts are still private; by the time + # this runs they are already on the download host. What it adds is a + # check written a different way — reading the exported files, through the + # `version` command rather than the flag — over the same artifacts the + # step below attaches to the GitHub release. If it ever disagrees with + # the pipeline, the export is what is wrong. + # + # The Linux amd64 binary is the one this runner can execute; the four are + # produced by one build with one set of variables, so it stands for all + # of them. + - name: Exported binaries still report the tag they were released under + env: + TAG: ${{ github.event.release.tag_name }} + COMMIT: ${{ github.sha }} + run: | + chmod +x ./build/linux/amd64/tapesctl + ./build/linux/amd64/tapesctl version | tee version.txt + grep -qx "tapesctl ${TAG}+${COMMIT:0:7}" version.txt + grep -qx "Sha: ${COMMIT}" version.txt + - name: Upload install script run: | - dagger call \ + nix develop --command dagger call \ upload-install-sh \ --endpoint=env://BUCKET_ENDPOINT \ --bucket=env://BUCKET_NAME \ From 0853d0acf21068105be98fc11bf45b3aea4fcc3b Mon Sep 17 00:00:00 2001 From: John McBride Date: Thu, 13 Aug 2026 16:08:27 -0500 Subject: [PATCH 5/5] chore: convert nightly workflow to Nix-managed Dagger --- .github/workflows/nightly.yaml | 39 +++++++++++++++++++++++++++------- 1 file changed, 31 insertions(+), 8 deletions(-) diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml index 0a106b0..b9678ff 100644 --- a/.github/workflows/nightly.yaml +++ b/.github/workflows/nightly.yaml @@ -8,9 +8,6 @@ on: permissions: contents: write -env: - DAGGER_VERSION: "0.21.8" - jobs: check: runs-on: depot-ubuntu-24.04 @@ -52,20 +49,32 @@ jobs: steps: - uses: actions/checkout@v4 - - name: Install Dagger - uses: dagger/dagger-for-github@v8.4.1 - with: - version: ${{ env.DAGGER_VERSION }} + - name: Install Nix + uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8 + + - name: Cache Nix store + uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14 - name: Move nightly tag up to HEAD run: | git tag -f nightly git push -f origin nightly + # `--commit` is what distinguishes tonight's nightly from last night's: + # every nightly reports the version name `nightly`, which the module + # supplies, so the commit is the whole of the artifact's identity. It has + # to be passed in because the Dagger module builds from a source directory + # with no `.git` in it. + # + # This step publishes: `nightly` syncs to the download prefix advertised + # in the release body below, and asks the built binary who it is before + # it syncs anything, so a nightly that cannot name its commit fails here + # with nothing uploaded. - name: Build and upload nightly artifacts run: | - dagger call \ + nix develop --command dagger call \ nightly \ + --commit="${{ github.sha }}" \ --endpoint=env://BUCKET_ENDPOINT \ --bucket=env://BUCKET_NAME \ --access-key-id=env://BUCKET_ACCESS_KEY_ID \ @@ -79,6 +88,20 @@ jobs: BUCKET_SECRET_ACCESS_KEY: ${{ secrets.BUCKET_SECRET_ACCESS_KEY }} DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }} + # A second opinion over the exported files, as in release.yaml: the gate + # is the pipeline's, this covers the GitHub release built from the export + # below. Worth the second on a nightly in particular — a nightly that + # cannot name its commit is indistinguishable from every other nightly, + # which is the whole of what a nightly has to offer. + - name: Exported binaries still report the commit they were built from + env: + COMMIT: ${{ github.sha }} + run: | + chmod +x ./build/linux/amd64/tapesctl + ./build/linux/amd64/tapesctl version | tee version.txt + grep -qx "tapesctl nightly+${COMMIT:0:7}" version.txt + grep -qx "Sha: ${COMMIT}" version.txt + - name: Update nightly GitHub release uses: ncipollo/release-action@v1 with: