From 7bed66c6968d9e1bac9a46244022ce7f1a6a4add Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Sat, 6 Jan 2024 21:18:42 +1000
Subject: [PATCH 01/17] build: use self-hosted runner for tests

---
 .github/workflows/tests.yml | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f5b1cd81..fa2764f8 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -28,7 +28,7 @@ env:
   CI_IPSO_VERSION: "v0.5"
 jobs:
   tests:
-    runs-on: ubuntu-latest
+    runs-on: nixos
     env:
       POST_BUILD_HOOK: ".github/workflows/postBuildHook"
     steps:
@@ -37,8 +37,6 @@ jobs:
         # `./scripts/recheck` uses `git diff` which accesses the repo's history. `fetch-depth: 0` fetches all branches and history.
         fetch-depth: 0
 
-    - uses: cachix/install-nix-action@v24
-
     # Used by `uploadToCache` to sign store paths.
     - run: "sudo bash -c 'echo \"${{ secrets.NIX_SIGNING_KEY }}\" > /run/nix-signing-key'"
 
@@ -84,19 +82,6 @@ jobs:
 
     - run: pueued -d
 
-    - name: cache .cargo
-      uses: actions/cache@v3
-      env:
-        cache-name: cache-crates-io-index
-      with:
-        path: |
-          ~/.cargo/registry/index
-          ~/.cargo/registry/src
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('Cargo.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('Cargo.lock') }}
-          ${{ runner.os }}-build-${{ env.cache-name }}-
-
     - name: "tests"
       if: github.event_name == 'pull_request'
       run: >

From fe0e5b718c0c772f19a4070225be060a4fcd5b05 Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Sat, 6 Jan 2024 21:24:34 +1000
Subject: [PATCH 02/17] build: bump actions/checkout to v4.0.0

---
 .github/workflows/tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index fa2764f8..18437169 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -32,7 +32,7 @@ jobs:
     env:
       POST_BUILD_HOOK: ".github/workflows/postBuildHook"
     steps:
-    - uses: actions/checkout@v2.4.0
+    - uses: actions/checkout@v4.0.0
       with:
         # `./scripts/recheck` uses `git diff` which accesses the repo's history. `fetch-depth: 0` fetches all branches and history.
         fetch-depth: 0

From 36129fd0d5c8411f5ba3f4b84f220a9ba50faf88 Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Mon, 15 Jan 2024 07:29:48 +1000
Subject: [PATCH 03/17] build: use Nix signing key present on machine

---
 .github/workflows/tests.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 18437169..a25e397d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -37,9 +37,6 @@ jobs:
         # `./scripts/recheck` uses `git diff` which accesses the repo's history. `fetch-depth: 0` fetches all branches and history.
         fetch-depth: 0
 
-    # Used by `uploadToCache` to sign store paths.
-    - run: "sudo bash -c 'echo \"${{ secrets.NIX_SIGNING_KEY }}\" > /run/nix-signing-key'"
-
     # Grants the Nix daemon access to the bucket, which allows `nix build` to
     # authenticate with the binary cache bucket and fetch cache items.
     - run: sudo mkdir /root/.aws

From f7e27393f4a328c60175dcca8d36af4167bb1300 Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Mon, 15 Jan 2024 07:35:21 +1000
Subject: [PATCH 04/17] build: use machine-local cache credentials

---
 .github/workflows/tests.yml | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a25e397d..d55dc8fb 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -37,17 +37,6 @@ jobs:
         # `./scripts/recheck` uses `git diff` which accesses the repo's history. `fetch-depth: 0` fetches all branches and history.
         fetch-depth: 0
 
-    # Grants the Nix daemon access to the bucket, which allows `nix build` to
-    # authenticate with the binary cache bucket and fetch cache items.
-    - run: sudo mkdir /root/.aws
-    - run: "sudo bash -c 'echo -e \"[default]\naws_access_key_id=${{ secrets.AWS_ACCESS_KEY_ID }}\naws_secret_access_key=${{ secrets.AWS_SECRET_ACCESS_KEY }}\" > /root/.aws/credentials'"
-
-    # Grants the runner access to the bucket, which allows `pueue` to
-    # authenticate with the binary cache bucket when pushing signed cache items.
-    - run: sudo mkdir ~/.aws
-    - run: sudo chown runner ~/.aws
-    - run: "echo -e \"[default]\naws_access_key_id=${{ secrets.AWS_ACCESS_KEY_ID}}\naws_secret_access_key=${{ secrets.AWS_SECRET_ACCESS_KEY }}\" > ~/.aws/credentials"
-
     # Allow the Nix daemon to execute the post-build-hook script.
     - run: "sudo chmod +x $POST_BUILD_HOOK"
 

From eeea96273606f8ff6ac55c73e7a1f0018062218e Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Mon, 15 Jan 2024 07:36:44 +1000
Subject: [PATCH 05/17] build: remove environment setup

---
 .github/workflows/tests.yml | 31 -------------------------------
 1 file changed, 31 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index d55dc8fb..f7120a0e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -37,37 +37,6 @@ jobs:
         # `./scripts/recheck` uses `git diff` which accesses the repo's history. `fetch-depth: 0` fetches all branches and history.
         fetch-depth: 0
 
-    # Allow the Nix daemon to execute the post-build-hook script.
-    - run: "sudo chmod +x $POST_BUILD_HOOK"
-
-    # Used in `postBuildHook`.
-    - run: sudo cp .github/workflows/uploadToCache /run/uploadToCache
-
-    # [note: installing Ipso binary]
-    #
-    # Installing an Ipso release binary leads to more reliable Nix caching (versus using `nix
-    # profile install`). See <https://github.com/LightAndLight/ipso/issues/407>.
-    - name: Install Ipso binary
-      run: |
-        mkdir -p $HOME/bin
-        curl -L \
-          "https://github.com/LightAndLight/ipso/releases/download/$CI_IPSO_VERSION/ipso-linux-x86_64" \
-          > $HOME/bin/ipso
-        chmod +x $HOME/bin/ipso
-        echo "$HOME/bin" >> $GITHUB_PATH
-
-    - run: nix profile install nixpkgs#pueue
-
-    # [note: nix profile install not adding to PATH]
-    #
-    # `nix profile install nixpkgs#pueue` used to "just work", but on 2023-03-02 I started getting
-    # `pueued: command not found` errors. So add it to the path manually.
-    #
-    # [Docs for `GITHUB_PATH`](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#adding-a-system-path)
-    - run: echo "$(readlink ~/.nix-profile)/bin" >> $GITHUB_PATH
-
-    - run: pueued -d
-
     - name: "tests"
       if: github.event_name == 'pull_request'
       run: >

From be2140cddf1647efa627fc50835906f8139cd6ba Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Mon, 15 Jan 2024 07:37:59 +1000
Subject: [PATCH 06/17] build: use machine-local post build hook

---
 .github/workflows/tests.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f7120a0e..20ce7283 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -29,8 +29,6 @@ env:
 jobs:
   tests:
     runs-on: nixos
-    env:
-      POST_BUILD_HOOK: ".github/workflows/postBuildHook"
     steps:
     - uses: actions/checkout@v4.0.0
       with:
@@ -43,7 +41,6 @@ jobs:
         nix develop .#tests
         --extra-substituters "s3://$BINARY_CACHE_BUCKET?scheme=https&endpoint=$BINARY_CACHE_ENDPOINT"
         --extra-trusted-public-keys "$NIX_PUBLIC_KEY"
-        --post-build-hook "$GITHUB_WORKSPACE/$POST_BUILD_HOOK"
         -c ./scripts/recheck origin/$GITHUB_BASE_REF $GITHUB_REF_NAME
 
     # `tests.yml` is currently set to run on pushes to `main`. When that happens, `$GITHUB_BASE_REF`
@@ -59,7 +56,6 @@ jobs:
         nix develop .#tests
         --extra-substituters "s3://$BINARY_CACHE_BUCKET?scheme=https&endpoint=$BINARY_CACHE_ENDPOINT"
         --extra-trusted-public-keys "$NIX_PUBLIC_KEY"
-        --post-build-hook "$GITHUB_WORKSPACE/$POST_BUILD_HOOK"
         -c ./scripts/recheck ${{ github.event.before }} $GITHUB_REF_NAME
 
     - name: wait for uploads to finish

From c8d22130780f2a4c654392c461b9774d3cf34557 Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Mon, 15 Jan 2024 08:48:27 +1000
Subject: [PATCH 07/17] build: use run-specific post build hook

---
 .github/workflows/tests.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 20ce7283..5c51089e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -39,8 +39,7 @@ jobs:
       if: github.event_name == 'pull_request'
       run: >
         nix develop .#tests
-        --extra-substituters "s3://$BINARY_CACHE_BUCKET?scheme=https&endpoint=$BINARY_CACHE_ENDPOINT"
-        --extra-trusted-public-keys "$NIX_PUBLIC_KEY"
+        --post-build-hook "$RUNNER_TEMP/postBuildHook-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER"
         -c ./scripts/recheck origin/$GITHUB_BASE_REF $GITHUB_REF_NAME
 
     # `tests.yml` is currently set to run on pushes to `main`. When that happens, `$GITHUB_BASE_REF`
@@ -54,8 +53,7 @@ jobs:
       if: github.event_name == 'push' && !github.event.forced
       run: >
         nix develop .#tests
-        --extra-substituters "s3://$BINARY_CACHE_BUCKET?scheme=https&endpoint=$BINARY_CACHE_ENDPOINT"
-        --extra-trusted-public-keys "$NIX_PUBLIC_KEY"
+        --post-build-hook "$RUNNER_TEMP/postBuildHook-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER"
         -c ./scripts/recheck ${{ github.event.before }} $GITHUB_REF_NAME
 
     - name: wait for uploads to finish
@@ -64,12 +62,12 @@ jobs:
 
     - name: log all uploads
       if: always()
-      run: pueue log --json | jq '.[].task.original_command' -r
+      run: pueue log --json | jq 'select(.[].task.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'")' | .[].task.original_command' -r
 
     - name: log failed uploads
       if: always()
-      run: pueue log --json | jq 'to_entries[] | select(.value.task.status.Done != "Success") | .key' -r | xargs -r pueue log
+      run: pueue log --json | jq 'select(.[].task.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'") | to_entries[] | select(.value.task.status.Done != "Success") | .key' -r | xargs -r pueue log
 
     - name: check uploads succeeded
       if: always()
-      run: "[ \"$(pueue log --json | jq 'to_entries[] | select(.value.task.status.Done != \"Success\") | .key' -r)\" == \"\" ]"
\ No newline at end of file
+      run: "[ \"$(pueue log --json | jq 'select (.[].task.label == \"'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'\") | to_entries[] | select(.value.task.status.Done != \"Success\") | .key' -r)\" == \"\" ]"
\ No newline at end of file

From c2c42c64e1a3427048c0289e237a70619262a15f Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Mon, 15 Jan 2024 08:58:37 +1000
Subject: [PATCH 08/17] build: fix typo

---
 .github/workflows/tests.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5c51089e..001ca7d9 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -62,7 +62,7 @@ jobs:
 
     - name: log all uploads
       if: always()
-      run: pueue log --json | jq 'select(.[].task.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'")' | .[].task.original_command' -r
+      run: pueue log --json | jq 'select(.[].task.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'") | .[].task.original_command' -r
 
     - name: log failed uploads
       if: always()

From 181921af120d33f4a6fd9bb55b68647ac2b1438b Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Tue, 16 Jan 2024 07:11:28 +1000
Subject: [PATCH 09/17] build: fix pueue wait conditions

---
 .github/workflows/tests.yml | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 001ca7d9..2b829449 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -57,17 +57,18 @@ jobs:
         -c ./scripts/recheck ${{ github.event.before }} $GITHUB_REF_NAME
 
     - name: wait for uploads to finish
-      if: always()
-      run: pueue wait
+      # This used to be always(), which can't be cancelled: <https://github.com/orgs/community/discussions/26303>
+      if: ${{ !cancelled() }}
+      run: pueue log --json | jq '.[].task | select(.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'") | .id' | xargs -r pueue wait
 
     - name: log all uploads
-      if: always()
+      if: ${{ !cancelled() }}
       run: pueue log --json | jq 'select(.[].task.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'") | .[].task.original_command' -r
 
     - name: log failed uploads
-      if: always()
+      if: ${{ !cancelled() }}
       run: pueue log --json | jq 'select(.[].task.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'") | to_entries[] | select(.value.task.status.Done != "Success") | .key' -r | xargs -r pueue log
 
     - name: check uploads succeeded
-      if: always()
+      if: ${{ !cancelled() }}
       run: "[ \"$(pueue log --json | jq 'select (.[].task.label == \"'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'\") | to_entries[] | select(.value.task.status.Done != \"Success\") | .key' -r)\" == \"\" ]"
\ No newline at end of file

From a8bbee6fd0a696e119e501bf2b9ccfc9a1ec1db2 Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Tue, 16 Jan 2024 07:52:49 +1000
Subject: [PATCH 10/17] build: restore cached directories after checkout action

---
 .github/workflows/tests.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2b829449..1c3e25a5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -34,6 +34,9 @@ jobs:
       with:
         # `./scripts/recheck` uses `git diff` which accesses the repo's history. `fetch-depth: 0` fetches all branches and history.
         fetch-depth: 0
+      
+    - name: "Restore cached directories"
+      run: restore
 
     - name: "tests"
       if: github.event_name == 'pull_request'

From cf0421256bbe896abaf0d47da4eb9a6741c7ceae Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Tue, 16 Jan 2024 08:05:23 +1000
Subject: [PATCH 11/17] build: save cached directories after build

---
 .github/workflows/tests.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 1c3e25a5..d17c4b97 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -58,6 +58,9 @@ jobs:
         nix develop .#tests
         --post-build-hook "$RUNNER_TEMP/postBuildHook-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER"
         -c ./scripts/recheck ${{ github.event.before }} $GITHUB_REF_NAME
+      
+    - name: "Save cached directories"
+      run: save
 
     - name: wait for uploads to finish
       # This used to be always(), which can't be cancelled: <https://github.com/orgs/community/discussions/26303>

From 1bd487a5700a591e518f092e6e3df6f518a58011 Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Wed, 17 Jan 2024 07:30:42 +1000
Subject: [PATCH 12/17] build: set CARGO_HOME and CARGO_TARGET_DIR

---
 .github/workflows/tests.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index d17c4b97..efd9b7bb 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -40,10 +40,12 @@ jobs:
 
     - name: "tests"
       if: github.event_name == 'pull_request'
-      run: >
-        nix develop .#tests
-        --post-build-hook "$RUNNER_TEMP/postBuildHook-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER"
-        -c ./scripts/recheck origin/$GITHUB_BASE_REF $GITHUB_REF_NAME
+      run: |
+        export CARGO_HOME=/var/cache/github-runner/.cargo
+        export CARGO_TARGET_DIR=$(realpath --relative-to "$PWD" /var/cache/github-runner/target)
+        nix develop .#tests \
+          --post-build-hook "$RUNNER_TEMP/postBuildHook-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER" \
+          -c ./scripts/recheck origin/$GITHUB_BASE_REF $GITHUB_REF_NAME
 
     # `tests.yml` is currently set to run on pushes to `main`. When that happens, `$GITHUB_BASE_REF`
     # isn't set because it's not a pull request. Instead we use the most recent commit before the

From e2e6a9f84bfc7b4db4c6984275df8dd9e4fea023 Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Wed, 17 Jan 2024 07:45:15 +1000
Subject: [PATCH 13/17] build: use CARGO_TARGET_DIR if present

---
 scripts/golden  | 2 +-
 scripts/shebang | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/golden b/scripts/golden
index 10c27a44..74d95569 100755
--- a/scripts/golden
+++ b/scripts/golden
@@ -2,4 +2,4 @@
 set -e
 
 cargo build
-ipso-golden --bin "$PWD/target/debug/ipso" --dir examples "$@"
\ No newline at end of file
+ipso-golden --bin "$PWD/${CARGO_TARGET_DIR:-target}/debug/ipso" --dir examples "$@"
\ No newline at end of file
diff --git a/scripts/shebang b/scripts/shebang
index d58d9f73..ef1573a9 100755
--- a/scripts/shebang
+++ b/scripts/shebang
@@ -2,4 +2,4 @@
 set -e
 
 cargo build
-env PATH="$PATH:$PWD/target/debug" ipso-shebang --dir examples/shebang "$@"
\ No newline at end of file
+env PATH="$PATH:$PWD/${CARGO_TARGET_DIR:-target}/debug" ipso-shebang --dir examples/shebang "$@"
\ No newline at end of file

From 92af745e6da959616875f5b1597efb38bb5fe6cd Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Wed, 17 Jan 2024 07:50:48 +1000
Subject: [PATCH 14/17] build: remove save/restore

---
 .github/workflows/tests.yml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index efd9b7bb..816f253d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -35,9 +35,6 @@ jobs:
         # `./scripts/recheck` uses `git diff` which accesses the repo's history. `fetch-depth: 0` fetches all branches and history.
         fetch-depth: 0
       
-    - name: "Restore cached directories"
-      run: restore
-
     - name: "tests"
       if: github.event_name == 'pull_request'
       run: |
@@ -61,9 +58,6 @@ jobs:
         --post-build-hook "$RUNNER_TEMP/postBuildHook-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER"
         -c ./scripts/recheck ${{ github.event.before }} $GITHUB_REF_NAME
       
-    - name: "Save cached directories"
-      run: save
-
     - name: wait for uploads to finish
       # This used to be always(), which can't be cancelled: <https://github.com/orgs/community/discussions/26303>
       if: ${{ !cancelled() }}

From 907456ec94929e301029a4216326b6f7c0bcfcb0 Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Wed, 17 Jan 2024 08:02:48 +1000
Subject: [PATCH 15/17] build: use state directory for persistent state

---
 .github/workflows/tests.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 816f253d..90f1e9c4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -38,8 +38,8 @@ jobs:
     - name: "tests"
       if: github.event_name == 'pull_request'
       run: |
-        export CARGO_HOME=/var/cache/github-runner/.cargo
-        export CARGO_TARGET_DIR=$(realpath --relative-to "$PWD" /var/cache/github-runner/target)
+        export CARGO_HOME=$STATE_DIRECTORY/.cargo
+        export CARGO_TARGET_DIR=$(realpath --relative-to "$PWD" $STATE_DIRECTORY/target)
         nix develop .#tests \
           --post-build-hook "$RUNNER_TEMP/postBuildHook-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER" \
           -c ./scripts/recheck origin/$GITHUB_BASE_REF $GITHUB_REF_NAME

From 8bf682a54b8e24209a91c91f26f72e1bb390bcfe Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Wed, 17 Jan 2024 08:19:58 +1000
Subject: [PATCH 16/17] build: clean up tests.yml

---
 .github/workflows/tests.yml | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 90f1e9c4..060be4e5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -13,19 +13,11 @@ on:
   workflow_dispatch:
 
 env:
-  NIX_PUBLIC_KEY: "ipso-binary-cache-1:UMRLNOKcCsb/a2dBhtcZhRZP4RN8yIDsSUwHTObu2w4="
-
-  # Note: these values are duplicated in the `UPLOAD_TO_CACHE` script.
-  BINARY_CACHE_BUCKET: "ipso-binary-cache"
-  BINARY_CACHE_ENDPOINT: "7065dc7f7d1813a29036535b4c4f4014.r2.cloudflarestorage.com"
-
   # Avoid [rate
   # limiting](https://discourse.nixos.org/t/flakes-provide-github-api-token-for-rate-limiting/18609)
   # by allowing Nix to make authenticated GitHub requests.
   NIX_CONFIG: "access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}"
 
-  # The version of ipso to use for CI scripts that are written in the language.
-  CI_IPSO_VERSION: "v0.5"
 jobs:
   tests:
     runs-on: nixos
@@ -35,7 +27,7 @@ jobs:
         # `./scripts/recheck` uses `git diff` which accesses the repo's history. `fetch-depth: 0` fetches all branches and history.
         fetch-depth: 0
       
-    - name: "tests"
+    - name: Run tests (pull request)
       if: github.event_name == 'pull_request'
       run: |
         export CARGO_HOME=$STATE_DIRECTORY/.cargo
@@ -51,26 +43,26 @@ jobs:
     # as the "old" commit for `./scripts/recheck`.
     #
     # If it's a force push (which it really shouldn't be for main) then we skip this step.
-    - name: "tests"
+    - name: Run tests (push)
       if: github.event_name == 'push' && !github.event.forced
       run: >
         nix develop .#tests
         --post-build-hook "$RUNNER_TEMP/postBuildHook-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER"
         -c ./scripts/recheck ${{ github.event.before }} $GITHUB_REF_NAME
       
-    - name: wait for uploads to finish
+    - name: Wait for uploads to finish
       # This used to be always(), which can't be cancelled: <https://github.com/orgs/community/discussions/26303>
       if: ${{ !cancelled() }}
       run: pueue log --json | jq '.[].task | select(.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'") | .id' | xargs -r pueue wait
 
-    - name: log all uploads
+    - name: Log all uploads
       if: ${{ !cancelled() }}
       run: pueue log --json | jq 'select(.[].task.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'") | .[].task.original_command' -r
 
-    - name: log failed uploads
+    - name: Log failed uploads
       if: ${{ !cancelled() }}
       run: pueue log --json | jq 'select(.[].task.label == "'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'") | to_entries[] | select(.value.task.status.Done != "Success") | .key' -r | xargs -r pueue log
 
-    - name: check uploads succeeded
+    - name: Check uploads succeeded
       if: ${{ !cancelled() }}
       run: "[ \"$(pueue log --json | jq 'select (.[].task.label == \"'$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER'\") | to_entries[] | select(.value.task.status.Done != \"Success\") | .key' -r)\" == \"\" ]"
\ No newline at end of file

From 0ad11e7f2c25645b4411782d373a118d78c80d1e Mon Sep 17 00:00:00 2001
From: Isaac Elliott <isaace71295@gmail.com>
Date: Wed, 17 Jan 2024 08:26:56 +1000
Subject: [PATCH 17/17] REMOVE ME: test binary cache uploads

---
 .github/workflows/tests.yml | 1 +
 flake.nix                   | 9 +++++++++
 2 files changed, 10 insertions(+)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 060be4e5..c4f005bb 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -30,6 +30,7 @@ jobs:
     - name: Run tests (pull request)
       if: github.event_name == 'pull_request'
       run: |
+        nix build .#test-package -L --option post-build-hook ""
         export CARGO_HOME=$STATE_DIRECTORY/.cargo
         export CARGO_TARGET_DIR=$(realpath --relative-to "$PWD" $STATE_DIRECTORY/target)
         nix develop .#tests \
diff --git a/flake.nix b/flake.nix
index da4c75bd..5dae785a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -35,6 +35,15 @@
           ipso-cli = (rustPkgs { release = true; }).workspace.ipso-cli {};
           ipso-golden = pkgs.haskell.lib.justStaticExecutables (import ./tests/golden { inherit pkgs; });
           ipso-shebang = pkgs.haskell.lib.justStaticExecutables (import ./tests/shebang { inherit pkgs; });
+          test-package = pkgs.stdenv.mkDerivation {
+            name = "test-package";
+            unpackPhase = "true";
+            buildPhase = "true";
+            installPhase = ''
+              mkdir $out
+              echo "test 4" > $out/test
+            '';
+          };
         };
 
         defaultPackage = packages.ipso-cli;