chore(ci): migrate to velnor-actions 0.1.9

.github/AGENTS.md

@@ -1,4 +1,4 @@
-# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate.
 # Generated GitHub Workflows and Configurations
 
 `velnor-actions` from [tailrocks/velnor-new](https://github.com/tailrocks/velnor-new) owns its declared generated paths, the complete `.github/workflows/` namespace, and marked shared action definitions under `.github/actions/`. Successful generation replaces emitted owned paths and retires owned paths no longer emitted. Do not hand-edit these managed paths; change their inputs and run `velnor-actions generate`.

.github/actionlint.yaml

@@ -1,4 +1,4 @@
-# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate.
 
 config-variables: []
 

.github/actions/tofu-provider-admission/action.yml

@@ -1,4 +1,4 @@
-# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate.
 name: Admit OpenTofu provider cache
 description: Restore and admit the exact OpenTofu provider cache entry.
 inputs:

.github/actions/u26/action.yml

@@ -1,4 +1,4 @@
-# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate.
 name: Velnor Mise cache identity
 description: Qualify the hosted image and cache roots before V2 restore.
 inputs:

.github/actions/velnor-tool-seed/action.yml

@@ -1,14 +1,19 @@
-# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate.
 name: Restore Velnor tool seed
 description: Copy a matching host tool seed into this job.
 inputs:
   cache_key:
     description: Exact Mise cache key.
     required: true
+outputs:
+  seed_admitted:
+    description: True only when the trusted seed matched and was copied.
+    value: ${{ steps.copy.outputs.seed_admitted }}
 runs:
   using: composite
   steps:
-    - name: Copy matching tool seed
+    - id: copy
+      name: Copy matching tool seed
       env:
         ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
         ACTIONS_ID_TOKEN_REQUEST_URL: ""
@@ -23,4 +28,4 @@ runs:
         NPM_TOKEN: ""
         SEED_KEY: ${{ inputs.cache_key }}
       shell: bash
-      run: "bash -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; set -euo pipefail; seed=\"/opt/velnor/seed\"; key=\"$SEED_KEY\"; if [ -z \"$key\" ]; then echo \"tool seed disabled\"; exit 0; fi; trusted_seed_owner_root() { if [ \"${RUNNER_OS-}\" = macOS ]; then /usr/bin/stat -f %u \"$1\" | /usr/bin/grep -qx 0; else /usr/bin/stat -c %u -- \"$1\" | /usr/bin/grep -qx 0; fi; }; trusted_seed_file_matches() { local file=\"$1\" expected=\"$2\" actual=\"\" size=\"\" newline=\"\"; [ -f \"$file\" ] && [ ! -L \"$file\" ] || return 1; if [ \"${RUNNER_OS-}\" = macOS ]; then IFS= read -r size < <(/usr/bin/stat -f %z \"$file\") || return 1; else IFS= read -r size < <(/usr/bin/stat -c %s -- \"$file\") || return 1; fi; case \"$size\" in '\\'''\\''|*[!0-9]*) return 1 ;; esac; [ \"$size\" -le 512 ] || return 1; if IFS= read -r -d '\\'''\\'' actual < \"$file\"; then return 1; fi; printf -v newline '\\''\\n'\\''; [ \"$actual\" = \"$expected\" ] || [ \"$actual\" = \"$expected$newline\" ]; }; trusted_seed_path_is_real() { local current=\"$1\"; while [ \"$current\" != / ]; do [ ! -L \"$current\" ] || return 1; current=\"${current%/*}\"; [ -n \"$current\" ] || current=/; done; }; trusted_seed_mount_is_immutable() { if [ \"${RUNNER_OS-}\" = macOS ]; then /sbin/mount | /usr/bin/awk -v seed=\"$1\" '\\''index($0, \" on \") { marker=index($0, \" on \"); source=substr($0, 1, marker-1); rest=substr($0, marker+4); options_at=index(rest, \" (\"); target=substr(rest, 1, options_at-1); mount_options=substr(rest, options_at+2); targets[NR]=target; sources[NR]=source; options[NR]=mount_options; if (target == seed) { exact++; seed_source=source; if (mount_options ~ /read-only|rdonly/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (sources[i] == seed_source && targets[i] != seed && options[i] !~ /read-only|rdonly/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; else /usr/bin/findmnt -arn -o TARGET,FSTYPE,MAJ:MIN,OPTIONS | /usr/bin/awk -v seed=\"$1\" '\\''{ target=$1; targets[NR]=target; devices[NR]=$3; options[NR]=$4; if (target == seed) { exact++; device=$3; if ($2 != \"overlay\" && $2 != \"fuse.overlayfs\" && $4 ~ /(^|,)ro(,|$)/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (devices[i] == device && targets[i] != seed && options[i] ~ /(^|,)rw(,|$)/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; fi; }; trusted_seed_tree_bounded() { local root=\"$1\" count=0 entry relative depth; if ! /usr/bin/find \"$root\" -xdev -print0 | while IFS= read -r -d '\\'''\\'' entry; do ((count+=1)); [ \"$count\" -le 100000 ] || exit 1; case \"$entry\" in \"$root\") depth=0 ;; \"$root\"/*) relative=\"${entry#\"$root\"/}\"; depth=1; while [[ \"$relative\" == */* ]]; do relative=\"${relative#*/}\"; ((depth+=1)); done ;; *) exit 1 ;; esac; [ \"$depth\" -le 16 ] || exit 1; done; then return 1; fi; }; trusted_seed_tree_entries_are_safe() { if ! /usr/bin/find \"$1\" -xdev \\( ! -type d -a ! -type f -o ! -uid 0 \\) -print0 | while IFS= read -r -d '\\'''\\'' entry; do exit 1; done; then return 1; fi; }; trusted_seed_tree_is_safe() { trusted_seed_tree_bounded \"$1\" && trusted_seed_tree_entries_are_safe \"$1\"; }; trusted_seed_is_trusted() { [ -d \"$1\" ] && [ ! -L \"$1\" ] || return 1; trusted_seed_path_is_real \"$1\" || return 1; [ -f \"$1/PROVENANCE\" ] && [ ! -L \"$1/PROVENANCE\" ] || return 1; trusted_seed_owner_root \"$1\" || return 1; trusted_seed_owner_root \"$1/PROVENANCE\" || return 1; trusted_seed_file_matches \"$1/PROVENANCE\" \"velnor-host-seed-v1\" || return 1; trusted_seed_mount_is_immutable \"$1\" || return 1; trusted_seed_tree_is_safe \"$1\"; }; if [ ! -e \"$seed\" ]; then echo \"tool seed absent\"; exit 0; fi; if ! trusted_seed_is_trusted \"$seed\"; then echo \"untrusted tool seed; continuing cold\"; exit 0; fi; if [[ ! \"$key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] || [ ! -f \"$seed/mise/KEY\" ]; then echo \"tool seed key mismatch\"; exit 0; fi; if ! trusted_seed_file_matches \"$seed/mise/KEY\" \"$key\"; then echo \"tool seed key mismatch\"; exit 0; fi; if [ -d \"$seed/mise/tree\" ]; then /bin/mkdir -p \"$HOME/.local/share/mise\"; /bin/cp -R \"$seed/mise/tree/.\" \"$HOME/.local/share/mise/\"; echo \"tool seed restored share-dir\"; fi; if [ -d \"$seed/rustup/tree\" ]; then /bin/mkdir -p \"$RUNNER_TEMP/velnor/rustup\"; /bin/cp -R \"$seed/rustup/tree/.\" \"$RUNNER_TEMP/velnor/rustup/\"; echo \"tool seed restored toolchain-dir\"; fi'"
+      run: "bash -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; set -euo pipefail; seed=\"/opt/velnor/seed\"; key=\"$SEED_KEY\"; if [ -z \"$key\" ]; then echo \"tool seed disabled\"; exit 0; fi; trusted_seed_owner_root() { if [ \"${RUNNER_OS-}\" = macOS ]; then /usr/bin/stat -f %u \"$1\" | /usr/bin/grep -qx 0; else /usr/bin/stat -c %u -- \"$1\" | /usr/bin/grep -qx 0; fi; }; trusted_seed_file_matches() { local file=\"$1\" expected=\"$2\" actual=\"\" size=\"\" newline=\"\"; [ -f \"$file\" ] && [ ! -L \"$file\" ] || return 1; if [ \"${RUNNER_OS-}\" = macOS ]; then IFS= read -r size < <(/usr/bin/stat -f %z \"$file\") || return 1; else IFS= read -r size < <(/usr/bin/stat -c %s -- \"$file\") || return 1; fi; case \"$size\" in '\\'''\\''|*[!0-9]*) return 1 ;; esac; [ \"$size\" -le 512 ] || return 1; if IFS= read -r -d '\\'''\\'' actual < \"$file\"; then return 1; fi; printf -v newline '\\''\\n'\\''; [ \"$actual\" = \"$expected\" ] || [ \"$actual\" = \"$expected$newline\" ]; }; trusted_seed_path_is_real() { local current=\"$1\"; while [ \"$current\" != / ]; do [ ! -L \"$current\" ] || return 1; current=\"${current%/*}\"; [ -n \"$current\" ] || current=/; done; }; trusted_seed_mount_is_immutable() { if [ \"${RUNNER_OS-}\" = macOS ]; then /sbin/mount | /usr/bin/awk -v seed=\"$1\" '\\''index($0, \" on \") { marker=index($0, \" on \"); source=substr($0, 1, marker-1); rest=substr($0, marker+4); options_at=index(rest, \" (\"); target=substr(rest, 1, options_at-1); mount_options=substr(rest, options_at+2); targets[NR]=target; sources[NR]=source; options[NR]=mount_options; if (target == seed) { exact++; seed_source=source; if (mount_options ~ /read-only|rdonly/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (sources[i] == seed_source && targets[i] != seed && options[i] !~ /read-only|rdonly/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; else /usr/bin/findmnt -arn -o TARGET,FSTYPE,MAJ:MIN,OPTIONS | /usr/bin/awk -v seed=\"$1\" '\\''{ target=$1; targets[NR]=target; devices[NR]=$3; options[NR]=$4; if (target == seed) { exact++; device=$3; if ($2 != \"overlay\" && $2 != \"fuse.overlayfs\" && $4 ~ /(^|,)ro(,|$)/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (devices[i] == device && targets[i] != seed && options[i] ~ /(^|,)rw(,|$)/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; fi; }; trusted_seed_tree_bounded() { local root=\"$1\" count=0 entry relative depth; if ! /usr/bin/find \"$root\" -xdev -print0 | while IFS= read -r -d '\\'''\\'' entry; do ((count+=1)); [ \"$count\" -le 100000 ] || exit 1; case \"$entry\" in \"$root\") depth=0 ;; \"$root\"/*) relative=\"${entry#\"$root\"/}\"; depth=1; while [[ \"$relative\" == */* ]]; do relative=\"${relative#*/}\"; ((depth+=1)); done ;; *) exit 1 ;; esac; [ \"$depth\" -le 16 ] || exit 1; done; then return 1; fi; }; trusted_seed_tree_entries_are_safe() { if ! /usr/bin/find \"$1\" -xdev \\( ! -type d -a ! -type f -o ! -uid 0 \\) -print0 | while IFS= read -r -d '\\'''\\'' entry; do exit 1; done; then return 1; fi; }; trusted_seed_tree_is_safe() { trusted_seed_tree_bounded \"$1\" && trusted_seed_tree_entries_are_safe \"$1\"; }; trusted_seed_is_trusted() { [ -d \"$1\" ] && [ ! -L \"$1\" ] || return 1; trusted_seed_path_is_real \"$1\" || return 1; [ -f \"$1/PROVENANCE\" ] && [ ! -L \"$1/PROVENANCE\" ] || return 1; trusted_seed_owner_root \"$1\" || return 1; trusted_seed_owner_root \"$1/PROVENANCE\" || return 1; trusted_seed_file_matches \"$1/PROVENANCE\" \"velnor-host-seed-v1\" || return 1; trusted_seed_mount_is_immutable \"$1\" || return 1; trusted_seed_tree_is_safe \"$1\"; }; if [ ! -e \"$seed\" ]; then echo \"tool seed absent\"; exit 0; fi; if ! trusted_seed_is_trusted \"$seed\"; then echo \"untrusted tool seed; continuing cold\"; exit 0; fi; if [[ ! \"$key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] || [ ! -f \"$seed/mise/KEY\" ]; then echo \"tool seed key mismatch\"; exit 0; fi; if ! trusted_seed_file_matches \"$seed/mise/KEY\" \"$key\"; then echo \"tool seed key mismatch\"; exit 0; fi; trusted_seed_tree_has_file() { /usr/bin/find \"$1\" -type f -print -quit | /usr/bin/grep -q .; }; copied=false; if [ -d \"$seed/mise/tree\" ] && trusted_seed_tree_has_file \"$seed/mise/tree\"; then /bin/mkdir -p \"$HOME/.local/share/mise\"; /bin/cp -R \"$seed/mise/tree/.\" \"$HOME/.local/share/mise/\"; echo \"tool seed restored share-dir\"; copied=true; fi; if [ -d \"$seed/rustup/tree\" ] && trusted_seed_tree_has_file \"$seed/rustup/tree\"; then /bin/mkdir -p \"$RUNNER_TEMP/velnor/rustup\"; /bin/cp -R \"$seed/rustup/tree/.\" \"$RUNNER_TEMP/velnor/rustup/\"; echo \"tool seed restored toolchain-dir\"; copied=true; fi; [ \"$copied\" = true ] || { echo \"tool seed has no copyable payload\"; exit 0; }; printf '\\''seed_admitted=true\\n'\\'' >> \"$GITHUB_OUTPUT\"'"

.github/actions/velnor-tools-cache-restore/action.yml

@@ -1,10 +1,14 @@
-# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate.
 name: Velnor Mise tools cache restore
 description: Restore the exact renderer-owned V2 Mise tools paths.
 inputs:
   key:
     description: Exact runtime-qualified V2 tools key.
     required: true
+  seed-admitted:
+    description: Whether the trusted V2 prelude copied the exact seed.
+    required: false
+    default: "false"
 runs:
   using: composite
   steps:
@@ -15,10 +19,11 @@ runs:
         key: ${{ inputs.key }}
         path: "~/.local/share/mise\n${{ runner.temp }}/velnor/rustup\n${{ runner.temp }}/velnor/cargo/.crates.toml\n${{ runner.temp }}/velnor/cargo/.crates2.json\n${{ runner.temp }}/velnor/cargo/bin"
         restore-keys: ""
-    - name: Discard tools bytes unless the exact restore key matched
+    - name: Keep only an exact cache hit or validated seed on a miss
       shell: bash
       env:
         TOOLS_CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}
         TOOLS_EXPECTED_KEY: ${{ inputs.key }}
         TOOLS_MATCHED_KEY: ${{ steps.restore.outputs.cache-matched-key }}
-      run: "set -eu;\n[ -n \"$HOME\" ] && [ -n \"$RUNNER_TEMP\" ] || exit 1;\ncase \"$HOME\" in /*) ;; *) exit 1 ;; esac;\ncase \"$RUNNER_TEMP\" in /*) ;; *) exit 1 ;; esac;\n[ \"$HOME\" != / ] && [ \"$RUNNER_TEMP\" != / ] || exit 1;\nif [ \"$TOOLS_CACHE_HIT\" = true ] && [ -n \"$TOOLS_EXPECTED_KEY\" ] && [ \"$TOOLS_MATCHED_KEY\" = \"$TOOLS_EXPECTED_KEY\" ]; then\n[ ! -L \"$HOME/.local/share/mise\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/rustup\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/bin\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates2.json\" ] || exit 1;\nexit 0;\nfi;\nfor d in \"$HOME/.local/share/mise\" \"$RUNNER_TEMP/velnor/rustup\" \"$RUNNER_TEMP/velnor/cargo/bin\"; do\n[ ! -L \"$d\" ] || exit 1;\nrm -rf \"$d\";\ndone;\nfor f in \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" \"$RUNNER_TEMP/velnor/cargo/.crates2.json\"; do\n[ ! -L \"$f\" ] || exit 1;\nrm -f \"$f\";\ndone"
+        TOOLS_SEED_ADMITTED: ${{ inputs.seed-admitted }}
+      run: "set -eu;\n[ -n \"$HOME\" ] && [ -n \"$RUNNER_TEMP\" ] || exit 1;\ncase \"$HOME\" in /*) ;; *) exit 1 ;; esac;\ncase \"$RUNNER_TEMP\" in /*) ;; *) exit 1 ;; esac;\n[ \"$HOME\" != / ] && [ \"$RUNNER_TEMP\" != / ] || exit 1;\ncache_hit=\"${TOOLS_CACHE_HIT-}\";\nexpected_key=\"${TOOLS_EXPECTED_KEY-}\";\nmatched_key=\"${TOOLS_MATCHED_KEY-}\";\nseed_admitted=\"${TOOLS_SEED_ADMITTED-}\";\nkeep=false;\nif [ \"$cache_hit\" = true ] && [[ \"$expected_key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] && [ \"$matched_key\" = \"$expected_key\" ]; then\nkeep=true;\nelif [ -z \"$cache_hit\" ] && [[ \"$expected_key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] && [ -z \"$matched_key\" ] && [ \"$seed_admitted\" = true ]; then\nkeep=true;\nfi;\nif [ \"$keep\" = true ]; then\n[ ! -L \"$HOME/.local/share/mise\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/rustup\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/bin\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates2.json\" ] || exit 1;\nexit 0;\nfi;\nfor d in \"$HOME/.local/share/mise\" \"$RUNNER_TEMP/velnor/rustup\" \"$RUNNER_TEMP/velnor/cargo/bin\"; do\n[ ! -L \"$d\" ] || exit 1;\nrm -rf \"$d\";\ndone;\nfor f in \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" \"$RUNNER_TEMP/velnor/cargo/.crates2.json\"; do\n[ ! -L \"$f\" ] || exit 1;\nrm -f \"$f\";\ndone"

.github/actions/velnor-tools-prelude-u26/action.yml

@@ -1,4 +1,4 @@
-# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.9; edit .velnor/config.toml and regenerate.
 name: Velnor hosted tools prelude
 description: Qualify the hosted image and copy a matching tool seed.
 inputs:
@@ -10,6 +10,8 @@ outputs:
     value: ${{ steps.v2.outputs.enabled }}
   identity:
     value: ${{ steps.v2.outputs.identity }}
+  seed_admitted:
+    value: ${{ steps.seed.outputs.seed_admitted }}
 runs:
   using: composite
   steps:
@@ -19,6 +21,7 @@ runs:
       with:
         d: ${{ inputs.d }}
     - name: Restore Velnor tool seed
+      id: seed
       if: steps.v2.outputs.enabled == 'true'
       uses: ./.github/actions/velnor-tool-seed # zizmor: ignore[self-repository]
       with: