From 4ef9648b02225138bcc343976e861a2a7b784c31 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 20:58:27 -0500 Subject: [PATCH 1/9] ci: refresh stale zed-lock pin reproducibly --- .github/workflows/fix-zed-lock-repro.yml | 51 ++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 .github/workflows/fix-zed-lock-repro.yml diff --git a/.github/workflows/fix-zed-lock-repro.yml b/.github/workflows/fix-zed-lock-repro.yml new file mode 100644 index 000000000..c5c640013 --- /dev/null +++ b/.github/workflows/fix-zed-lock-repro.yml @@ -0,0 +1,51 @@ +name: fix zed lock reproducibility + +on: + push: + branches: + - fix-zed-lock-repro + workflow_dispatch: + +permissions: + contents: write + +jobs: + repair-and-certify: + runs-on: ubuntu-24.04 + timeout-minutes: 30 + steps: + - name: Check out repair branch + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + ref: fix-zed-lock-repro + fetch-depth: 0 + + - name: Install repository Rust toolchain + uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 + with: + toolchain: 1.98.1 + components: rustfmt,clippy + + - name: Refresh only the stale zed-lock pin + run: cargo update -p zed-lock + + - name: Certify formatted locked build + run: | + cargo fmt --all -- --check + cargo build --locked --release --bin zed + + - name: Commit lock repair when required + shell: bash + run: | + set -euo pipefail + if git diff --quiet -- Cargo.lock; then + echo "Cargo.lock already reproducible" + exit 0 + fi + git diff --check -- Cargo.lock + git diff -- Cargo.lock + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add Cargo.lock + git commit -m "build: refresh zed-lock pin" + git push origin HEAD:fix-zed-lock-repro From 5d8cf9ddd2a6c0ff9322deae2710f6a4ab0557c3 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 21:01:34 -0500 Subject: [PATCH 2/9] ci: repair rustfmt and lock drift before certification --- .github/workflows/fix-zed-lock-repro.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/fix-zed-lock-repro.yml b/.github/workflows/fix-zed-lock-repro.yml index c5c640013..e6d5a743b 100644 --- a/.github/workflows/fix-zed-lock-repro.yml +++ b/.github/workflows/fix-zed-lock-repro.yml @@ -26,6 +26,9 @@ jobs: toolchain: 1.98.1 components: rustfmt,clippy + - name: Normalize Rust formatting + run: cargo fmt --all + - name: Refresh only the stale zed-lock pin run: cargo update -p zed-lock @@ -34,18 +37,18 @@ jobs: cargo fmt --all -- --check cargo build --locked --release --bin zed - - name: Commit lock repair when required + - name: Commit deterministic repair when required shell: bash run: | set -euo pipefail - if git diff --quiet -- Cargo.lock; then - echo "Cargo.lock already reproducible" + if git diff --quiet; then + echo "Repository is already reproducible" exit 0 fi - git diff --check -- Cargo.lock - git diff -- Cargo.lock + git diff --check + git diff -- Cargo.lock tests/toml_contract.rs git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add Cargo.lock - git commit -m "build: refresh zed-lock pin" + git add Cargo.lock tests/toml_contract.rs + git commit -m "build: repair locked zed-cli build" git push origin HEAD:fix-zed-lock-repro From 46c5e263bfc2b5c8c483fd5d7ffc7c61e538adbe Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Sun, 13 Sep 2026 02:04:15 +0000 Subject: [PATCH 3/9] build: repair locked zed-cli build --- Cargo.lock | 3 +-- tests/toml_contract.rs | 8 +++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 34d224b12..9d03f946d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2229,11 +2229,10 @@ dependencies = [ [[package]] name = "zed-lock" version = "0.1.1" -source = "git+https://github.com/zed-pkg/zed-lock.git?rev=1a95bb87272ac7b08895cea1f61743cf40321213#1a95bb87272ac7b08895cea1f61743cf40321213" +source = "git+https://github.com/zed-pkg/zed-lock.git?rev=1db0da00d30fcf2e0762f50eedb1f88458020b52#1db0da00d30fcf2e0762f50eedb1f88458020b52" dependencies = [ "anyhow", "fs2", - "libc", ] [[package]] diff --git a/tests/toml_contract.rs b/tests/toml_contract.rs index 04b406f49..1a4ec8bbd 100644 --- a/tests/toml_contract.rs +++ b/tests/toml_contract.rs @@ -9,8 +9,7 @@ fn root() -> PathBuf { fn parse_toml(path: &Path) -> toml::Value { let text = fs::read_to_string(path) .unwrap_or_else(|error| panic!("failed to read {}: {error}", path.display())); - toml::from_str(&text) - .unwrap_or_else(|error| panic!("invalid TOML {}: {error}", path.display())) + toml::from_str(&text).unwrap_or_else(|error| panic!("invalid TOML {}: {error}", path.display())) } fn string_at<'a>(value: &'a toml::Value, path: &[&str]) -> &'a str { @@ -133,7 +132,10 @@ fn global_flags_do_not_reuse_environment_keys_or_public_aliases() { if alias == canonical_alias { continue; } - assert!(aliases.insert(alias.to_owned()), "duplicate global flag alias: {alias}"); + assert!( + aliases.insert(alias.to_owned()), + "duplicate global flag alias: {alias}" + ); } } } From 83ebb3012b7d36360ad47c233cfa74a9d0e3a082 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 21:06:58 -0500 Subject: [PATCH 4/9] chore: remove one-shot repair workflow --- .github/workflows/fix-zed-lock-repro.yml | 54 ------------------------ 1 file changed, 54 deletions(-) delete mode 100644 .github/workflows/fix-zed-lock-repro.yml diff --git a/.github/workflows/fix-zed-lock-repro.yml b/.github/workflows/fix-zed-lock-repro.yml deleted file mode 100644 index e6d5a743b..000000000 --- a/.github/workflows/fix-zed-lock-repro.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: fix zed lock reproducibility - -on: - push: - branches: - - fix-zed-lock-repro - workflow_dispatch: - -permissions: - contents: write - -jobs: - repair-and-certify: - runs-on: ubuntu-24.04 - timeout-minutes: 30 - steps: - - name: Check out repair branch - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 - with: - ref: fix-zed-lock-repro - fetch-depth: 0 - - - name: Install repository Rust toolchain - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 - with: - toolchain: 1.98.1 - components: rustfmt,clippy - - - name: Normalize Rust formatting - run: cargo fmt --all - - - name: Refresh only the stale zed-lock pin - run: cargo update -p zed-lock - - - name: Certify formatted locked build - run: | - cargo fmt --all -- --check - cargo build --locked --release --bin zed - - - name: Commit deterministic repair when required - shell: bash - run: | - set -euo pipefail - if git diff --quiet; then - echo "Repository is already reproducible" - exit 0 - fi - git diff --check - git diff -- Cargo.lock tests/toml_contract.rs - git config user.name "github-actions[bot]" - git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add Cargo.lock tests/toml_contract.rs - git commit -m "build: repair locked zed-cli build" - git push origin HEAD:fix-zed-lock-repro From 344d432a6f94d4b1cfa02228ec36623c7484177a Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:10:56 -0500 Subject: [PATCH 5/9] test: remove duplicate registry_for import --- src/install_graph/hardening_tests.rs | 1 - 1 file changed, 1 deletion(-) diff --git a/src/install_graph/hardening_tests.rs b/src/install_graph/hardening_tests.rs index 1cce2fc22..ccfe6d52f 100644 --- a/src/install_graph/hardening_tests.rs +++ b/src/install_graph/hardening_tests.rs @@ -156,4 +156,3 @@ fn sequenced_receive_buffers_later_failures_until_earlier_results_arrive() { .to_string(); assert!(error.contains("later lockfile entry failed"), "{error}"); } -use crate::registry::registry_for; From 70e02eb7dc9a423d4465fd421ce5b150b16451b6 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:19:27 -0500 Subject: [PATCH 6/9] fix: restore canonical CLI flags contract metadata --- .zpkg.toml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.zpkg.toml b/.zpkg.toml index bcf0a0aa5..c9b117b1c 100644 --- a/.zpkg.toml +++ b/.zpkg.toml @@ -11,6 +11,11 @@ language = "rust" vcs = "git" url = "https://github.com/zed-pkg/zed-cli" +[cli] +flags_contract = ".cli-flags.toml" +flags_runtime = "flags-2-env" +primary_bin = "zed" + [build] command = "cargo build --release --locked --bins" outputs = [ From 9ffbb76014bb567239a63648c6be5c4f172c9f36 Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:26:46 -0500 Subject: [PATCH 7/9] fix: keep CLI flags metadata in its separate canonical contract --- .zpkg.toml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.zpkg.toml b/.zpkg.toml index c9b117b1c..bcf0a0aa5 100644 --- a/.zpkg.toml +++ b/.zpkg.toml @@ -11,11 +11,6 @@ language = "rust" vcs = "git" url = "https://github.com/zed-pkg/zed-cli" -[cli] -flags_contract = ".cli-flags.toml" -flags_runtime = "flags-2-env" -primary_bin = "zed" - [build] command = "cargo build --release --locked --bins" outputs = [ From 611da9528940267235ed28391c3b05443380902d Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:27:01 -0500 Subject: [PATCH 8/9] test: align CLI flags contract with zed-interfaces manifest authority --- tests/toml_contract.rs | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/tests/toml_contract.rs b/tests/toml_contract.rs index 1a4ec8bbd..d1f34cc22 100644 --- a/tests/toml_contract.rs +++ b/tests/toml_contract.rs @@ -57,18 +57,16 @@ fn zed_package_version_matches_the_native_release_version() { } #[test] -fn zed_package_declares_the_canonical_flags_runtime_and_contract() { +fn zed_cli_flags_remain_a_separate_canonical_contract() { let root = root(); let zpkg = parse_toml(&root.join(".zpkg.toml")); let cargo = parse_toml(&root.join("Cargo.toml")); let flags = parse_toml(&root.join(".cli-flags.toml")); - assert_eq!( - string_at(&zpkg, &["cli", "flags_contract"]), - ".cli-flags.toml" + assert!( + zpkg.get("cli").is_none(), + ".zpkg.toml must stay within the zed-interfaces Manifest authority; CLI flags belong in .cli-flags.toml" ); - assert_eq!(string_at(&zpkg, &["cli", "flags_runtime"]), "flags-2-env"); - assert_eq!(string_at(&zpkg, &["cli", "primary_bin"]), "zed"); let flags2env = cargo .get("dependencies") From e97a0cba1ffe6770bbd50b4df8590f1864cd53bc Mon Sep 17 00:00:00 2001 From: Alexander Mills Date: Sat, 12 Sep 2026 22:34:22 -0500 Subject: [PATCH 9/9] fix: do not require an unpublished package lock in smoke validation --- .zpkg.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.zpkg.toml b/.zpkg.toml index bcf0a0aa5..7502e0bb5 100644 --- a/.zpkg.toml +++ b/.zpkg.toml @@ -37,7 +37,7 @@ dir = ".vendor/.zed" [publish] include_readme = true tag_format = "v{version}" -smoke_test = "test -f \"$ZED_PKG_TEST_TARGET/.auth-shared.toml\" && test ! -e \"$ZED_PKG_TEST_TARGET/.shared-auth.toml\" && test -x \"$ZED_PKG_TEST_TARGET/target/release/zed\" && test -x \"$ZED_PKG_TEST_TARGET/target/release/zed-gitops\" && test -x \"$ZED_PKG_TEST_TARGET/target/release/zed-git-install\" && \"$ZED_PKG_TEST_TARGET/target/release/zed\" --version && \"$ZED_PKG_TEST_TARGET/target/release/zed\" validate --manifest \"$ZED_PKG_TEST_TARGET/.zpkg.toml\" --lock \"$ZED_PKG_TEST_TARGET/.zpkg.lock\" --json >/dev/null && \"$ZED_PKG_TEST_TARGET/target/release/zed\" gitops validate --help && \"$ZED_PKG_TEST_TARGET/target/release/zed-git-install\" --help >/dev/null" +smoke_test = "test -f \"$ZED_PKG_TEST_TARGET/.auth-shared.toml\" && test ! -e \"$ZED_PKG_TEST_TARGET/.shared-auth.toml\" && test -x \"$ZED_PKG_TEST_TARGET/target/release/zed\" && test -x \"$ZED_PKG_TEST_TARGET/target/release/zed-gitops\" && test -x \"$ZED_PKG_TEST_TARGET/target/release/zed-git-install\" && \"$ZED_PKG_TEST_TARGET/target/release/zed\" --version && \"$ZED_PKG_TEST_TARGET/target/release/zed\" validate --manifest \"$ZED_PKG_TEST_TARGET/.zpkg.toml\" --json >/dev/null && \"$ZED_PKG_TEST_TARGET/target/release/zed\" gitops validate --help && \"$ZED_PKG_TEST_TARGET/target/release/zed-git-install\" --help >/dev/null" exclude = [ ".env", ".env.*",